South Korea-US Joint Alert on North Korean IT Personnel... "Identity Verification and Account Checks Required"

Using Multiple Accounts for Salary Receipt Raises 'Suspicion'

South Korea and the United States jointly issued an advisory warning domestic and foreign companies and individuals not to employ North Korean IT personnel who disguise their nationality and identity, or assist their activities.

The advisory, jointly announced on the 19th by South Korea's Ministry of Foreign Affairs, National Intelligence Service, and National Police Agency, along with the U.S. Department of State and Federal Bureau of Investigation (FBI), adds recent trends to the “Joint Government Advisory on North Korean IT Personnel” previously issued by the South Korean and U.S. governments on December 8 and May 16 of last year, respectively.

The joint advisory introduced new methods and activity patterns reportedly used by North Korean IT personnel to conceal their identities. It also provided additional precautionary measures that IT companies can take to prevent inadvertently hiring North Korean personnel.

Indicators to identify North Korean IT personnel include cases where the employment candidate ▲shows signs of misconduct during interviews, ▲has inconsistencies between the languages used on their resume and their claimed region of origin, ▲requests alternative payment methods instead of providing account information for salary payments, or ▲submits a cargo transport company's exclusive address instead of a home address as the delivery location for company-provided items.

A booklet published by the Ministry of Foreign Affairs on North Korea's illegal foreign currency earning activities in cyberspace and the South Korean government's response status

In response, IT companies are advised to conduct thorough background checks on employment candidates, exercise caution in verifying the employer’s account and actual address, and implement enhanced security measures to protect company networks and confidential information, among other additional precautions.

Ordering work and making payments to North Korean IT personnel not only damages a company’s reputation but also exposes the company to risks such as North Korean personnel accessing confidential information or stealing assets. Since such actions may violate United Nations Security Council sanctions on North Korea as well as domestic laws in South Korea and the U.S., special caution is required.

In South Korea, receiving services from North Korean personnel without government approval can be punished under Article 27, Paragraph 1, Subparagraph 4 of the Inter-Korean Exchange and Cooperation Act.

The government recommends reporting any suspected cases of North Korean IT personnel disguising their identity and nationality to illegally secure contracts from Korean companies to relevant authorities such as the National Intelligence Service and the National Police Agency. The government stated, “We will continue to work to block North Korea’s illegal cyber activities and create a safe cyber environment based on cooperation with the international community and private sector collaboration.”

This content was produced with the assistance of AI translation services.