North Korean IT workers: advisory from NZ’s NCSC and Police

New Zealand’s National Cyber Security Centre (NCSC) and New Zealand Police have published a joint advisory (TLP CLEAR, October 2026) on Democratic People’s Republic of Korea (DPRK) IT workers trying to get hired by New Zealand organisations. It describes how they operate, the red flags and the checks to put in place so you don’t hire them without realising it.

What happened

According to the advisory, the DPRK has deployed thousands of highly skilled IT workers around the world, seeking jobs in software development, website design, graphic design and IT services. The goal is to raise revenue for the North Korean government, including for its nuclear weapons and ballistic missile programmes, while evading UN sanctions. These workers may also try to obtain foreign intellectual property and steal data for ransom.

The NCSC and Police report cases of DPRK IT workers attempting, and in some cases succeeding, to obtain employment in New Zealand and overseas. Companies using global contractors, especially through freelance platforms, may onboard them without noticing. The most likely targets are government agencies, defence contractors, technology companies, financial institutions, large corporates and any business with access to sensitive information, critical services, strategic technologies or international commercial networks. Some workers go through recruitment agencies to present a more legitimate persona.

How they operate

They pose as remote freelancers using false identities. The methods listed in the advisory:

• stolen or purchased identities, sometimes sourced from public registers;
• fabricated CVs and references, deepfake or AI-assisted interview responses;
• operating mainly from China, Laos and Russia, using VPNs and remote desktop tools to mask their location;
• coordination through GitHub, Telegram, LinkedIn, Upwork and other platforms.

In some cases, after being dismissed, workers have threatened to disclose proprietary information, trying to leak company data or sell it to competitors.

There are also New Zealanders used unknowingly to hide the workers’ identity and location: they receive mail at their address, including company laptops; they log into the laptops and set up VPN access so the activity appears to come from their New Zealand IP address; they receive payments and forward them to the DPRK worker’s account.

The red flags

On their own they don’t signify illicit activity, but according to the advisory, especially when two or more are present, they should trigger increased due diligence.

Identity: multiple online profiles with different photos or none; contact only via social media or messaging apps; refusal to appear on camera or use of AI masking tools; inconsistent or changing ID details; inconsistent work history or online presence; westernised names or pseudonyms; stolen or doctored New Zealand identities, including driver’s licences and passports; fake business email addresses created to pass reference checks.

Location and access, the most useful for those who run the systems:

• requests to ship hardware to an address different from the one on the ID;
• accessing systems through remote login instead of the corporate device provided;
• use of remote desktop sharing and control software;
• activity outside declared or expected business hours, and difficulty reaching the worker during working hours;
• being logged on continuously for more than 24 hours;
• multiple logins to one account from different IP addresses in a short time, including from different countries.

Payments: China-based bank accounts, requests to be paid in cryptocurrency or through payment platforms.

Impact for European and Italian companies

The advisory concerns New Zealand and mentions no cases in Europe or Italy. However, the methods it describes rely on tools used everywhere: freelance platforms, recruitment agencies, remote-only interviews, remote access to systems. For NIS2 entities, human resources security and access control are part of the risk management measures: verifying identity and limiting the privileges of remote contractors belong to the same work. The European Union also applies the UN sanctions against North Korea, so paying these workers is a legal issue too, to be assessed with your advisers.

What to do now

The measures recommended by New Zealand’s NCSC and Police:

1. Verify identity: name, nationality, location, contact details, education and work history must be consistent across the application, ID, social media and payment platforms. Look for forgery in documents and verify qualifications and references directly with the institutions and companies, not through the contact details supplied by the applicant.
2. Don’t rely on recruitment agencies alone to verify the worker’s identity.
3. Be wary of VoIP numbers, run reverse image searches on profile photos to spot AI edits, prefer in-person interviews or at least one meeting at a local office, and be suspicious if the worker can’t receive mail at the address on their ID.
4. Don’t rush onboarding: grant access only after completing all hiring procedures and validating identity with official documents.
5. Payments: no cryptocurrency, only a bank account in the name of the verified person; be suspicious of requests to pay accounts in different names and to communicate outside verified platforms.
6. Limit access to sensitive information on a need-to-know basis, with access controls and reduced permissions.
7. Require all workers, especially remote-only ones, to use a managed corporate device instead of remote login from other devices.
8. Monitor corporate devices: abnormal access patterns, VPN anomalies and remote desktop applications that could mask location.
9. Audit your current remote-only workers, looking for suspicious activity and red flags.

How ARXDOME helps

ARX Sentry shows logons, night-time logons, remote desktop and bursts of attempts in the SOC pages, with events enriched with the country of origin; its software and process inventory helps find unexpected remote control tools or VPN clients on company machines. With ARX Horizon you can check the geolocation and reputation of a suspicious IP address from the portal, and with ARX Shield you can isolate a machine from the network while you investigate.

Last updated: 9 October 2026