Background
A joint alert issued by the United States and partner governments and agencies on July 31, 2026, says North Korean IT workers obtain contracts and income under false identities. The alert says workers may operate from North Korea, China, Russia, Southeast Asian countries, and African countries. They seek work in web, mobile, software, and blockchain development. The alert also describes team-based operations.
The stated risks extend beyond misrepresentation. The alert links the activity to insider threats, data exfiltration, cryptocurrency theft, theft of sensitive information, fraudulent foreign-exchange trading, sanctions evasion, and revenue supporting North Korea’s unlawful nuclear weapons and ballistic missile programs.
UN Security Council Resolution 2397 requires UN member states, subject to limited exceptions, to repatriate North Korean nationals earning income within their jurisdictions. The alert also says that contracting with North Korean IT workers or paying them may violate domestic laws in countries including Japan, the United States, and the Republic of Korea. The Financial Action Task Force identifies North Korea as a high-risk jurisdiction and calls for measures addressing money laundering, terrorist financing, proliferation financing, and sanctions-evasion risks.