The Australian government has sanctioned two North Korean companies over schemes involving workers using fake identities to secure jobs overseas, as US authorities launch a major crackdown on a network of operatives funnelling millions of dollars back to Pyongyang.
Governments around the world have raised concerns in recent years about North Korean workers posing as foreign nationals to secure remote jobs, with their earnings ultimately channelled back to the regime.
Last week, the Australian government sanctioned two North Korean nationals previously identified by US authorities as key financial brokers for Pyongyang.
They were named as Sim Hyon Sop and Yu Py Ung.
It also imposed sanctions on two companies accused of employing North Korean workers who had misrepresented their nationalities to obtain jobs.
Foreign Minister Penny Wong said the practice was a “violation of UN Security Council resolutions that prohibit North Korea’s export of labour”.
“Australian sanctions reinforce our ongoing efforts, alongside international partners, to disrupt North Korea’s illicit revenue-generating networks and increase pressure on the regime to comply with its international obligations and abandon its nuclear and ballistic missile programs,” Wong said.
US crackdown
Meanwhile, the US Justice Department this week announced a series of charges and arrests, alongside the seizure of nearly 200 computers, as part of a crackdown on a remote IT worker operation that had infiltrated more than 70 companies.
Authorities, including the FBI have identified these North Korean operations for several years, attempting to identify the networks and shut down their operations.
Australian companies have also been targeted, with behavioural intelligence firm Dtex warning earlier this year that numerous local organisations had already been compromised.
The US Justice Department said North Korean IT workers had applied for and secured remote positions at American companies between 2019 and mid-2025 using stolen or fabricated identities.
They also relied on VPNs and proxy infrastructure to make it appear they were working from within the US.
Once hired, the operatives worked with US-based “facilitators” who received company-issued laptops and housed them at so-called “laptop farms”.
The many faces of Sim Hyon Sop. Source: US Department of State
The devices were configured with remote-access software, allowing North Korean workers to operate them from overseas while appearing to be working locally.
Their earnings were then funnelled into accounts controlled by North Korea, the department said.
The scheme affected more than 70 companies across healthcare, communications, cyber support, retail and manufacturing, generating more than $US4 million ($6 million).
“North Korea continues to deploy remote IT workers using stolen identities to infiltrate American companies and generate revenue for the regime and its weapons programs,” FBI Cyber Division assistant director Brett Leatherman said in a statement.
Fake identities and laptop farms
US authorities have charged 14 individuals allegedly involved in the operation, made two arrests and conducted operations at more than 40 suspected laptop farms in Texas.
“North Korea’s rogue regime uses its pervasive IT worker schemes to raise revenue for various illicit purposes, including the development of weapons that could ultimately target the US or its allies,” US Assistant Attorney General for National Security John A Eisenberg said.
“These schemes threaten the security of the IT systems and data of the deceived US employers and leave countless victims of identity theft. NSD, along with our law enforcement partners, will use every available tool to track down anyone assisting the DPRK and to protect our national security.”
Cybersecurity firm CrowdStrike said in a blog post that it had worked with the FBI to disrupt the laptop farms.
The company said North Korean operatives had used a range of tactics to ensure company-issued devices reached their intended destinations.
These included filing fake police reports claiming laptops had been stolen to obtain replacements, cycling through residential addresses to conceal their final destination and arranging last-minute relocations.
The operation is not the only way North Korean operatives have been targeting organisations and technology workers.
North Korean cybercriminals have also been posting fake job advertisements that use bait-and-switch tactics to trick applicants into installing malware on their own systems.
In late 2024, Google researchers identified North Korean nationals infiltrating companies across multiple industries in the US, Europe and Australia.
Among the cases was a security awareness training provider that had unknowingly onboarded a remote worker based in North Korea.
The operative had used a genuine but stolen US identity and AI-generated photographs to circumvent background checks, and had successfully passed four video interviews.
Shortly after the company sent the worker a laptop, malware was installed on the device.
