Germany and several other countries have issued a public warning concerning North Korean IT specialists. A joint statement released by the German Foreign Office, along with several EU nations, the United States and Canada, Japan, and South Korea, revealed that North Korea is increasingly relying on a network of IT professionals operating both inside and outside the country. These specialists are employed to acquire false identities and generate income through remote work.
These illicit earnings are used to fund North Korea’s nuclear weapons and missile programs.
The alert is directed at countries, companies, and various other actors. The IT specialists frequently pose as citizens of other nations to find work on online platforms, directing their salaries to North Korean agencies. Furthermore, they are reportedly involved in internal threats against companies, facilitating data leaks, and participating in the theft of cryptocurrencies and sensitive information.
This warning builds upon a previous report published in October 2025 by a multilateral sanctions monitoring team, which detailed how North Korea was circumventing UN sanctions through cyber activities. The statement reiterated that the threat posed by these North Korean IT professionals remains under active observation and combating efforts.
According to UN Security Council Resolution 2397, all UN member states are obligated to repatriate North Korean nationals who are earning income abroad. Engaging in contracts with these IT specialists could therefore violate national laws and lead to legal repercussions. Moreover, the anti-money laundering working group classifies North Korea as a high-risk country.
The joint declaration urgently calls on all countries, companies, and other stakeholders to examine the North Korean IT specialist system in greater detail and to take measures to counter the listed tactics. Companies operating online platforms, in particular, are urged to strengthen their countermeasures by improving identity verification processes and enhancing the detection of suspicious accounts.
