On May 16, 2022, the State Department, Treasury and FBI issued an advisory to alert the international community, the private sector, and the public to attempts by the Democratic People’s Republic of Korea (DPRK) and DPRK information technology workers to obtain employment while posing as non-DPRK nationals. The advisory provides detailed information on how DPRK IT workers operate and identifies red flags to help companies avoid hiring DPRK freelance developers and to help freelance and digital payment platforms identify DPRK IT workers abusing their services.
The advisory provides information on DPRK entities that have been designated for sanctions by the UN and United States, including the 313 General Bureau of the Munitions Industry Department, the Ministry of Atomic Energy Industry, military entities subordinate to the Ministry of Defense and Korea People’s Army, and other lesser-known entities. The advisory describes how DPRK IT workers operate such as their skills and the platforms they use, how they hide their identity, and how their resumes are typically designed.
The advisory also listed red flag indicators that freelance work and payment platform companies, and companies employing freelance developers should be aware of. These include, among others:
Multiple logins into one account from various IP addresses in a relatively short period of time;
Developers are logging into multiple accounts on the same platform from one IP address
Developers are logged into their accounts continuously for one or more days at a time;
Use of digital payment services, especially PRC-linked services;
Surprisingly simple portfolio websites, social media profiles, or developer profiles; and
Seeking payment in virtual currency in an effort to evade KYC/AML measures and use of the formal financial system
In addition, a Fact Sheet, "Guidance on the Democratic People's Republic of Korea Information Technology Workers" has also been published.
Read the Treasury’s press release here.
The Advisory can be found here.
The Fact Sheet can be found here.