South Korea sanctions 15 North Koreans for IT worker scams, financial hacking schemes | CyberScoop<\/title> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/south-korea-sanctions-north-koreans-it-worker-scams\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"South Korea sanctions 15 North Koreans for IT worker scams, financial hacking schemes\"> <meta property=\"og:description\" content=\"The individuals are allegedly working for North Korea\u2019s 313th General Bureau, under the DPRK\u2019s Ministry of Munitions Industry.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/south-korea-sanctions-north-koreans-it-worker-scams\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2024-12-26T21:14:38+00:00\"> <meta property=\"article:modified_time\" content=\"2024-12-26T21:14:39+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/south-korea-sanctions-15-north-koreans-for-it-worker-scams-financial-hacking-schemes-2.jpg\"> <meta property=\"og:image:width\" content=\"4293\"> <meta property=\"og:image:height\" content=\"2862\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"djohnson\"> <meta name=\"twitter:card\" content=\"summary_large_image\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1732206022g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1730999764g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1732010462g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=ddc036fa194c40cf406f\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/82979\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.7.1\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=82979\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fsouth-korea-sanctions-north-koreans-it-worker-scams%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fsouth-korea-sanctions-north-koreans-it-worker-scams%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-82979 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/south-korea-sanctions-north-koreans-it-worker-scams\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--event js-stickybar\">\n<div class=\"stickybar__details\" readability=\"5.12\">\n<div class=\"stickybar__info js-sticky-bar-content\" readability=\"32\">\n<p>Nominations can be submitted for the 2025 CyberScoop 50 awards!<\/p>\n<\/div>\n<p> <a class=\"stickybar__link button button-tertiary\" href=\"https:\/\/cyberscoop.com\/cyberscoop50\/\">Click here!<\/a> <\/div>\n<p> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.382488479263\">\n<div class=\"single-article__header-content\" readability=\"34.704057279236\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/south-korea-sanctions-north-koreans-it-worker-scams\/\"> <span>Cybercrime<\/span> <\/a> <\/li>\n<\/ul>\n<p> The individuals are allegedly working for North Korea\u2019s 313th General Bureau, under the DPRK\u2019s Ministry of Munitions Industry. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/82979\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"426\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/south-korea-sanctions-15-north-koreans-for-it-worker-scams-financial-hacking-schemes.jpg?resize=640%2C426&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/south-korea-sanctions-15-north-koreans-for-it-worker-scams-financial-hacking-schemes-2.jpg 4293w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/south-korea-sanctions-15-north-koreans-for-it-worker-scams-financial-hacking-schemes-2.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/south-korea-sanctions-15-north-koreans-for-it-worker-scams-financial-hacking-schemes-2.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/south-korea-sanctions-15-north-koreans-for-it-worker-scams-financial-hacking-schemes-2.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/south-korea-sanctions-15-north-koreans-for-it-worker-scams-financial-hacking-schemes-2.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/south-korea-sanctions-15-north-koreans-for-it-worker-scams-financial-hacking-schemes-2.jpg?resize=2048,1365 2048w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/south-korea-sanctions-15-north-koreans-for-it-worker-scams-financial-hacking-schemes-2.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/south-korea-sanctions-15-north-koreans-for-it-worker-scams-financial-hacking-schemes-2.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/south-korea-sanctions-15-north-koreans-for-it-worker-scams-financial-hacking-schemes-2.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/south-korea-sanctions-15-north-koreans-for-it-worker-scams-financial-hacking-schemes-2.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/south-korea-sanctions-15-north-koreans-for-it-worker-scams-financial-hacking-schemes-2.jpg?resize=1265,843 1265w\" sizes=\"(max-width: 1013px) 100vw, 1013px\"><figcaption> (Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"27.949557284679\"><body readability=\"56.364661654135\"><\/p>\n<p>The South Korean government has sanctioned more than a dozen individuals and one organization for a wide-ranging global scheme to fund North Korea\u2019s nuclear and missile programs through impersonating IT workers abroad, stealing cryptocurrency and facilitating cyberattacks.<\/p>\n<p>South Korean officials on Thursday identified 15 North Korean nationals and the Chosun Geumjeong Economic Information Technology Exchange Corporation for economic sanctions. The individuals are allegedly working for North Korea\u2019s 313<sup>th<\/sup> General Bureau, part of the DPRK\u2019s Ministry of Munitions Industry, which oversees Pyongyang\u2019s weapons production, research and development and ballistic missile programs.<\/p>\n<p>The individuals and others \u201care known to be dispatched to China, Russia, Southeast Asia, Africa, and other countries as employees of regime-affiliated organizations such as the Ministry of Defense, disguising their identities and receiving work from IT companies around the world, while some are also known to be involved in information theft and cyberattacks,\u201d <a href=\"https:\/\/down.mofa.go.kr\/www\/brd\/m_4080\/view.do?seq=375771&page=1&pitem=10\">according<\/a> to a machine-translated press release from South Korea\u2019s Peninsula Policy Bureau.<\/p>\n<p>The Chosun Geumjeong Economic Information Technology Exchange Corporation is described as a company that \u201cdispatches many North Korean IT personnel overseas and pays a large amount of military funds to the North Korean regime,\u201d according to the release.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>North Koreans posing as IT workers to gain employment at Western firms \u2014 bypassing work restrictions and earning revenue for their home government \u2014 has become a frequent occurrence in recent years. The growing trend has increasingly alarmed U.S. and Western national security officials, as well as company executives who have <a href=\"https:\/\/cyberscoop.com\/cyber-firm-knowbe4-hired-a-fake-it-worker-from-north-korea\/\">publicly come forward with their experiences<\/a> after being duped.<\/p>\n<p>Beyond just earning a paycheck, placing North Korean operatives in technical roles at Western firms can also make it easier to <a href=\"https:\/\/cyberscoop.com\/north-korea-it-worker-fraud-tennesee-justice-department\/\">carry out hacking<\/a> operations and cryptocurrency theft. In some cases, these workers have installed malicious software on company devices, stolen hundreds of thousands of dollars from companies and attempted <a href=\"https:\/\/cyberscoop.com\/hypr-hired-fraudulent-tech-worker-overseas\/\">to gain access<\/a> to sensitive software building environments. Some executives suggest the issue is likely worse than the public understands, as the stigma of hiring a fraudulent employee still pushes companies to keep quiet.<\/p>\n<p>South Korea also accused its northern neighbor of playing an outsized role in global cryptocurrency theft. A 2024 <a href=\"https:\/\/documents.un.org\/doc\/undoc\/gen\/n24\/032\/68\/pdf\/n2403268.pdf\">report<\/a> by a United Nations panel stated that it is investigating at least 58 cyberattacks by DPRK operatives against cryptocurrency companies between 2017 and 2023, with the incidents yielding an estimated $3 billion in stolen gains. The panel also investigated \u201creports of numerous Democratic People\u2019s Republic of Korea nationals working overseas earning income in violation of sanctions, including in the information technology, restaurant and construction sectors.\u201d<\/p>\n<p>In addition to threatening the overall cyber ecosystem, South Korea said the actions pose \u201ca serious threat to international peace and security in that it is being used to fund North Korea\u2019s nuclear and missile development.\u201d<\/p>\n<p> <\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"3.6629213483146\">\n<div class=\"author-card\" readability=\"13\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/12\/south-korea-sanctions-15-north-koreans-for-it-worker-scams-financial-hacking-schemes-1.jpg?w=640&ssl=1\" alt=\"Derek B. Johnson\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by Derek B. Johnson<\/h4>\n<p> Derek B. Johnson is a reporter at CyberScoop, where his beat includes cybersecurity, elections and the federal government. Prior to that, he has provided award-winning coverage of cybersecurity news across the public and private sectors for various publications since 2017. Derek has a bachelor\u2019s degree in print journalism from Hofstra University in New York and a master\u2019s degree in public policy from George Mason University in Virginia. <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Geopolitics<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/south-korea-sanctions-north-koreans-it-worker-scams\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>South Korea sanctions 15 North Koreans for IT worker scams,<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[282,647,2911,3125],"tags":[286,240,2913,3130],"class_list":["post-6744","post","type-post","status-publish","format-standard","hentry","category-cybercrime","category-north-korea","category-north-korean-it-workers","category-south-korea","tag-cybercrime","tag-north-korea","tag-north-korean-it-workers","tag-south-korea"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybercrime\/\" rel=\"category tag\">cybercrime<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/north-korea\/\" rel=\"category tag\">North Korea<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/north-korean-it-workers\/\" rel=\"category tag\">North Korean IT workers<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/south-korea\/\" rel=\"category tag\">South Korea<\/a>","tag_info":"South Korea","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/6744","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=6744"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/6744\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=6744"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=6744"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=6744"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":6744,"date":"2024-12-26T15:14:38","date_gmt":"2024-12-26T21:14:38","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=82979"},"modified":"2024-12-26T15:14:38","modified_gmt":"2024-12-26T21:14:38","slug":"south-korea-sanctions-15-north-koreans-for-it-worker-scams-financial-hacking-schemes","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/12\/26\/south-korea-sanctions-15-north-koreans-for-it-worker-scams-financial-hacking-schemes\/","title":{"rendered":"South Korea sanctions 15 North Koreans for IT worker scams, financial hacking schemes"},"content":{"rendered":"