Suspected N. Korean IT worker found at S. Korean firm under false identity for 1st time

Police in South Korea are investigating a suspected North Korean IT worker who was hired under a false identity by a private company last year, the first such case authorities have disclosed. The worker reportedly performed development work, and police are tracing payments and investigating possible organized links. The case comes amid warnings that North Korean IT workers use fraudulent identities to earn money for Pyongyang and a recent U.S. crackdown on similar schemes.

Police said they independently detected the suspected case last year.

In July, 11 countries, including South Korea, the United States and Japan, issued an alert about North Korean IT workers’ use of false identities and increasingly sophisticated methods, including AI.

The multinational alert warned that the workers could pose insider threats through data exfiltration, cryptocurrency theft and the theft of sensitive information.

U.S. authorities searched more than 40 suspected laptop farm sites in Texas and seized about 187 laptops and other devices in a scheme involving more than 70 U.S. companies.

Published Oct 23, 2026 2:48 pm KST

Concerns grow that wages of N. Korean IT workers hired worldwide under false identities fund Pyongyang's nuclear, missile programs

Police are investigating North Korean information technology (IT) workers suspected of taking jobs at a South Korean company under false identities, the first time authorities have disclosed such a case.

The case raises concern that wages earned through such employment are funding Pyongyang’s weapons development, amid a recent large-scale U.S. crackdown on similar remote employment fraud.

Police said Thursday that they independently detected one suspected case last year in which a North Korean IT worker fraudulently took a job. The worker was reportedly hired by a private South Korean company and carried out development work. Police are tracing the amount and method of payments while also probing possible organized links.

North Korean IT workers are increasingly landing remote jobs at global companies under forged identities and with fast-evolving artificial intelligence (AI) tools, funneling their earnings to Pyongyang.

In July, 11 countries, including South Korea, the United States and Japan, issued an alert warning that North Korea relies on a network of skilled IT workers to fund its nuclear weapons and ballistic missile programs.

“North Korean IT workers impersonate nationals of other countries to obtain work and income through online platforms operated by private companies for employment, procurement, and contracting of services,” the alert said, adding that the workers are using increasingly sophisticated methods, including AI, to hide their identities and expand their activities globally.

The alert added that the workers also pose an insider threat to companies by engaging in data exfiltration, cryptocurrency theft and theft of sensitive information.

A suspected North Korean IT worker who was asked to insult North Korean leader Kim Jong-un in a test based on Kim’s status as a sacred figure in the country / Captured from X (formerly Twitter)

In April, a video went viral showing a suspected North Korean applicant with a false identity being asked to insult North Korean leader Kim Jong-un, a test based on Kim’s status as a sacred figure in the country.

In the video, the applicant was asked to insult Kim with words like “fat ugly pig.” He pretended not to understand, then ended the call.

Earlier this month, the U.S. Department of Justice announced the results of a joint crackdown targeting remote employment fraud by North Korean IT workers. Authorities uncovered “laptop farms” that receive company-provided laptops for the workers to access remotely, concealing their true location.

"North Korea continues to deploy remote IT workers using stolen identities to infiltrate American companies and generate revenue for the regime and its weapons programs," Assistant Director Brett Leatherman of the FBI's Cyber Division said.

Authorities searched more than 40 suspected laptop farm sites in Texas and seized about 187 laptops and other devices in connection with a scheme that victimized more than 70 U.S. companies.

“This investigation is about far more than fraud,” said U.S. Attorney Ryan Raybould for the Northern District of Texas.

“It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability,” Raybould added.

韩国警方正在调查一名涉嫌使用虚假身份受雇于一家私营公司的朝鲜籍IT从业人员，这是当局披露的首例此类案件。据报道，该从业人员从事开发工作，警方正在追踪款项来源并调查可能的有组织犯罪团伙。此案正值外界警告称朝鲜IT从业人员利用虚假身份为平壤牟利，以及美国近期对类似犯罪活动进行打击之际。

警方表示，他们去年就独立发现了这起疑似案件。

7 月，包括韩国、美国和日本在内的 11 个国家发出警报，指出朝鲜 IT 工作人员使用虚假身份和日益复杂的技术（包括人工智能）。

该跨国警报警告称，这些工人可能通过数据泄露、加密货币盗窃和敏感信息盗窃构成内部威胁。

美国当局搜查了德克萨斯州 40 多个疑似笔记本电脑销售点，查获了约 187 台笔记本电脑和其他设备，该犯罪活动涉及 70 多家美国公司。

发布于2026年10月23日下午2:48（韩国标准时间）

人们越来越担心，朝鲜在全球范围内以虚假身份雇佣的IT工作者的工资可能被用于资助平壤的核武器和导弹计划。

警方正在调查涉嫌使用虚假身份在韩国公司工作的朝鲜信息技术（IT）人员，这是当局首次披露此类案件。

此案引发了人们的担忧，即通过此类工作获得的工资可能被用于资助平壤的武器研发，而美国最近也对类似的远程就业欺诈行为进行了大规模打击。

警方周四表示，他们去年独立侦破了一起疑似案件，一名朝鲜籍IT从业人员以欺诈手段获得工作机会。据报道，该从业人员受雇于一家韩国私营公司，从事开发工作。警方正在追查款项数额和支付方式，同时也在调查是否存在有组织的犯罪团伙。

越来越多的朝鲜IT工作者利用伪造身份和快速发展的人工智能（AI）工具，在全球公司获得远程工作，并将收入输送到平壤。

7 月，包括韩国、美国和日本在内的 11 个国家发出警告，称朝鲜依靠技术娴熟的 IT 工作者网络为其核武器和弹道导弹计划提供资金。

警报称，“朝鲜IT从业人员冒充其他国家的国民，通过私营公司运营的在线平台获取工作和收入，这些平台用于就业、采购和服务承包。”警报还补充说，这些从业人员正在使用越来越复杂的方法，包括人工智能，来隐藏自己的身份，并将业务扩展到全球。

该警报还补充说，这些工人还会通过数据泄露、加密货币盗窃和敏感信息盗窃等方式对公司构成内部威胁。

一名疑似朝鲜籍IT从业人员被要求在一次测试中侮辱朝鲜领导人金正恩，理由是金正恩在朝鲜拥有神圣的地位 / 图片来自X（原推特）

今年四月，一段视频在网上疯传，视频中一名疑似朝鲜籍的应聘者使用假身份，被要求侮辱朝鲜领导人金正恩。这项测试是基于金正恩在朝鲜的神圣地位而进行的。

视频中，应聘者被要求用“又肥又丑的猪”之类的词语侮辱金正恩。他假装没听懂，然后挂断了电话。

本月初，美国司法部公布了一项联合打击朝鲜IT从业人员远程就业欺诈行动的成果。当局查获了一些“笔记本电脑农场”，这些农场接收公司提供的笔记本电脑供员工远程使用，从而掩盖了员工的真实位置。

“朝鲜继续利用窃取的身份信息，派遣远程 IT 人员渗透美国公司，为朝鲜政权及其武器计划创造收入，”联邦调查局网络部门助理主任布雷特·莱瑟曼表示。

当局搜查了德克萨斯州 40 多个疑似笔记本电脑窝点，并查获了约 187 台笔记本电脑和其他设备，这些设备与一起侵害了 70 多家美国公司的犯罪计划有关。

“这项调查涉及的远不止欺诈，”德克萨斯州北区联邦检察官瑞安·雷博尔德说。

雷布尔德补充说：“这关乎一个敌对的外国政权如何通过窃取的身份信息和潜入我们境内的秘密通道渗透美国公司。我们每拆除一个‘笔记本电脑工厂’，就切断了朝鲜政府赖以资助威胁全球稳定的武器项目的收入来源。”