a person in a hoodie sitting in front of a laptop
Share this @internewscast.com

BRITS could be helping North Korean spies pose as IT workers to infiltrate Western companies, an intelligence report has warned.

The fake IT workers are hired for fully remote jobs using stolen or fake identities to earn cash for Kim Jong-un’s regime.

a person in a hoodie sitting in front of a laptop
North Korean spies are posing as fake IT workers to infiltrate UK companiesCredit: Getty
Kim Jong-Un in Vladivostok.
The cash from the IT worker scams is being sent straight back to Kim Jong-un’s regimeCredit: Getty
a rocket is launched into the sky over the ocean
It is thought to be being used to fund North Korea’s evil military program

Once inside the North Korean fraudsters exploit the companies – stealing funds and information.

The scams have had a devastating impact on companies across the country and left them wondering just how North Korea pulled them off.

Now, an intelligence report has revealed that Brits could have been helping all along.

The latest findings from Google’s Threat Intelligence reveal that North Korean operatives employ “local facilitators” to assist them in securing employment and verifying their identities.

These intermediaries utilize remote desktop software enabling North Korean workers to access a company’s internal servers remotely, creating the illusion of being based within the country.

Google’s investigation uncovered that a laptop provided by a U.S. firm was operating out of London, raising concerns that British individuals might be entangled in this dubious network.

Principal i3 Insider Investigator at DTEX Systems, Michael Barnhart, told The Sun: “The London-based facilitator previously acted as the primary ‘farmer’ and enterprise representative in the operation, having established a front company in collaboration with another facilitator who was the main North Korean IT worker.”

Barnhart said that all evidence of the operation has now been removed.

This follows a wider trend across the US where American citizens have been accused of helping the fake IT workers remain undetected.

Matthew Knoot, 38, was arrested for allegedly helping North Korean workers in Nashville, Tennessee last year.

Kim Jong Un blows up the ground in North Korea as part of a building project

Knoot allegedly helped the workers use stolen identities to pose as US citizens and hosted company laptops at his home.

From there he ran a “laptop farm” – allowing the North Korean actors to log in to the computers from China.

Knoot is also believed to have helped launder money from the remote IT jobs to accounts tied to North Korean and Chinese actors.

United States Attorney Henry Leventis said at the time that Knoot helped funnel hundreds of thousands of dollars to the North Korean government through the scheme.

HOW DO THE SCAMS WORK?

The North Korean spies reportedly use stolen or fake identities to set up accounts on remote job sites – including LinkedIn, Upwork and Freelancer – to apply for work.

And to make sure they’re not detected they use “aliases, false or fraudulent personae and proxies,” according to the HM Treasury’s Office of Financial Sanctions Implementations.

Once they make it to interview stage, they often use AI-generated deepfakes to look and sound like the person they are claiming to be.

These AI deep-fakes are becoming increasingly easy to purchase, with a full identity complete with an ID doc and proof of address available from as little as $200 on the dark web. 

Head of National Security Intelligence at Chainanalysis Andrew Fierman told The Sun: “All you need are a few photos and a very small clip of voice of the person you’re attempting to be and you can effectively be that person”

Photo of an Estonian passport's data page, showing security features and holder's information.
A fake passport belonging to a North Korean worker posing as an EstonianCredit: DTEX Systems
Polish identity card.
An identity card belonging to a North Korean worker posing as a PoleCredit: DTEX systems

After being recruited the North Korean workers use their stolen credentials to breeze through the onboarding process.

And they often ask their employers to send their work laptops to front addresses – run by “local facilitators” – which allows them to remain undetected.

Once fully onboarded the fraudsters work hard to establish themselves within the company, gaining its trust before they pounce.

Companies often allow high-performing workers to refer future employees – allowing them to slowly amass an army of cyber warriors.

They then set about hatching plans to “exploit and steal funds from the organisations”. 

Fierman explained that there are a number of cunning tactics that the North Korean workers use.

Fierman said: “It’s all about getting someone within an organisation to give you an access point unknowingly.”

He added: “For example, if it’s bonus season and North Korea knows it’s bonus season at your organisation, they might send out an email saying here’s the details of your upcoming bonus.

“Somebody is going to get excited and click the link and then they’ve given North Korea access to the entire infrastructure of their organisation.”

These sly tactics allow the North Korean workers to access sensitive information as well as money.

They reportedly use this information as a bargaining chip if needed – dishing out threats of sharing it with competitors.

UK sanctions on North Korea

DPRK targets are on OFSI’s  consolidated list of financial sanctions and are subject to an asset freeze.

This regime also includes sectoral financial sanctions, which contain both restrictions and requirements. These include those placed on:

  • The sale or purchase of bonds
  • DPRK credit and financial institutions including branches, subsidiaries and representative offices)
  • UK credit and financial institutions from dealing with DPRK credit and financial institutions (including branches, subsidiaries and representative offices)
  • Representative offices belonging to designated persons
  • Business arrangements with designated persons
  • Financial support for trade
  • Investment and commercial activities
  • Bank accounts for DPRK diplomats and diplomatic missions
  • Leasing or, otherwise making available, real property

Source: HM Treasury’s Office of Financial Sanctions Implementations (OFSI)

KIM’S CASH-STARVED REGIME

North Korea has been hit by many sanctions over the years forcing Kim Jong-un to think outside the box.

The tyrant has long relied on cyber activity to fund his cash-starved regime and the fake IT worker scams are the latest in a string of shady tactics.

Fierman told The Sun: “None of these North Korean workers are operating of their own will or fruition, they’re doing it on behalf of the North Korean government.”

And it’s thought that the money is going straight into the country’s weapons programmes.

A UN investigation in 2022 confirmed these suspicions and said that cyber attacks were an “important revenue source” for Pyongyang’s nuclear and ballistic missile programme

The recent worker scams come after a shocking crypto heist saw North Korea’s Lazarus Group accused of stealing $1.2billion back in February.

Hackers were able to gain control of an Ethereum wallet and rip all of its contents, in what has been dubbed the largest heist in crypto’s history.

Share this @internewscast.com
You May Also Like
Julian McMahon dies after cancer battle

Julian McMahon Passes Away Following Cancer Struggle

McMahon gained fame for his role as the plastic surgeon Dr. Christian…
JSO: Woman shot, killed during party on Rover Drive hour after Fourth of July

JSO: Woman Fatally Shot at Rover Drive Party Just After Fourth of July Celebrations

The Jacksonville Sheriff’s Office said five people were detained following the deadly…
Hakeem Jeffries Reemerges, Doubles Down on Democrats' Big Lie About OBBB and the American Dream

Hakeem Jeffries Resurfaces, Reinforces Democrats’ False Narrative on OBBB and the American Dream

The Democrats tell dishonest statements so often, it’s hard sometimes to rank…
UN commission accuses Israel of 'extermination' in controversial report

UN Criticized for Funding Committee Aiming to Undermine Israel, Despite Financial Shortfall

Critics have expressed outrage at the United Nations for allocating funds to…
Can We Get Rid of the Disgraceful American Federation of Teachers Yet?

Randi Weingarten’s July 4th Tweet Drew Laughter – But Not in the Way She Intended

Many people were acknowledging Independence Day on Friday.  A post by Randi…
Donald Trump speaking to reporters aboard Air Force One.

Trump Lashes Out: Putin Wants to Continue Killing in Ukraine, Claims He’s ‘Very Unhappy’ After Hour-Long Call with Vladimir

Donald Trump sounded a grim alarm over Putin’s intentions to “continue the…
Kerrville, Texas flooding: Camp girls missing after Guadalupe River flood waters hit Camp Mystic; at least 27 dead

Tragic Flood in Kerrville, Texas: Girls Missing from Camp Mystic After Guadalupe River Overflow; Death Toll Rises to 27

In KERRVILLE, Texas, search efforts continued Saturday as rescuers worked to locate…
Julian McMahon's 'Charmed' co-stars remembers the late actor: 'One of a kind'

Julian McMahon’s Former ‘Charmed’ Cast Members Pay Tribute: ‘Truly Unique’

The women of “Charmed” are remembering their late co-star. Julian McMahon, who…
Back of the Yards, Chicago shooting: At least 7 seriously injured in mass shooting in 4800-block of South Justine Street, CPD says

Mass Shooting in Chicago’s Back of the Yards: 7 Suffer Serious Injuries on South Justine Street, Police Report

CHICAGO (WLS) — Chicago police reported that at least seven individuals sustained…
Multiple arrested as anti-ICE protesters clash with police, US troops in Los Angeles

Numerous Arrests at Los Angeles Protest as Anti-ICE Demonstrators Face Off with Police and US Troops

On Friday, several individuals were taken into custody in Los Angeles as…
Texas floods kill at least 24; search for missing continues

At Least 24 Dead in Texas Floods; Search for Missing People Ongoing

The destructive force of the fast-rising waters just before dawn Friday washed…
South Philly shooting today: At least 8 wounded in mass shooting inside 7 Elements Restaurant Bar and Lounge in Philadelphia, PA

8 Injured in Mass Shooting at South Philly’s 7 Elements Restaurant Bar and Lounge Today

PHILADELPHIA — Eight people were wounded in a mass shooting early Saturday…