WASHINGTON (TNND) — The U.S. and several of its allies issued an alert on Friday over North Korean IT workers funding their country’s weapons programs by using false identities.
The FBI and State Department issued the advisory along with agencies from Japan, South Korea, the U.K., Australia, New Zealand, France, Germany, Italy, the Netherlands, and Canada.
“Today, the FBI, alongside @StateDept and international partners, released a joint alert on the threat posed by North Korean IT workers,” the bureau posted on X on Friday. “North Korea continues to rely on a network of skilled IT personnel who use false identities, third-party proxies, and increasingly sophisticated methods to conduct malicious cyber activity and generate revenue in support of its unlawful weapons programs.
“Investigating and disrupting these schemes remains a top priority for the FBI as we work to protect U.S. companies. So far in 2026 alone, eight individuals have been sentenced to prison for their roles in these schemes. The alert outlines common tactics used and provides guidance for countries, companies, and online platforms to help identify and mitigate this threat. We urge organizations to stay vigilant and review the full alert for recommendations.”
According to the advisory, “North Korean IT workers impersonate nationals of other countries to obtain work and income through online platforms operated by private companies for employment, procurement, and contracting of services. These workers seek out contracts with the intent of remitting their salaries to their parent North Korean agencies. They also pose an insider threat to companies and are involved in data exfiltration, cryptocurrency theft, and theft of sensitive information.”
The agencies also noted that the workers are using more sophisticated methods, including AI, to hide their identities.