{
	"id": "05cf6e2b-70c4-4aea-b674-f118fab618a4",
	"created_at": "2026-04-06T00:19:00.09152Z",
	"updated_at": "2026-04-10T03:21:39.00457Z",
	"deleted_at": null,
	"sha1_hash": "8e2cbb106393c53c29f52bcc66e87477af4411cb",
	"title": "South Korea sanctions 15 North Koreans for IT worker scams, financial hacking schemes",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 35378,
	"plain_text": "South Korea sanctions 15 North Koreans for IT worker scams,\r\nfinancial hacking schemes\r\nBy Derek B. Johnson\r\nPublished: 2024-12-26 · Archived: 2026-04-05 16:51:34 UTC\r\nThe South Korean government has sanctioned more than a dozen individuals and one organization for a wide-ranging global scheme to fund North Korea’s nuclear and missile programs through impersonating IT workers\r\nabroad, stealing cryptocurrency and facilitating cyberattacks.\r\nSouth Korean officials on Thursday identified 15 North Korean nationals and the Chosun Geumjeong Economic\r\nInformation Technology Exchange Corporation for economic sanctions. The individuals are allegedly working for\r\nNorth Korea’s 313th General Bureau, part of the DPRK’s Ministry of Munitions Industry, which oversees\r\nPyongyang’s weapons production, research and development and ballistic missile programs.\r\nThe individuals and others “are known to be dispatched to China, Russia, Southeast Asia, Africa, and other\r\ncountries as employees of regime-affiliated organizations such as the Ministry of Defense, disguising their\r\nidentities and receiving work from IT companies around the world, while some are also known to be involved in\r\ninformation theft and cyberattacks,” according to a machine-translated press release from South Korea’s Peninsula\r\nPolicy Bureau.\r\nThe Chosun Geumjeong Economic Information Technology Exchange Corporation is described as a company that\r\n“dispatches many North Korean IT personnel overseas and pays a large amount of military funds to the North\r\nKorean regime,” according to the release.\r\nNorth Koreans posing as IT workers to gain employment at Western firms — bypassing work restrictions and\r\nearning revenue for their home government — has become a frequent occurrence in recent years. The growing\r\ntrend has increasingly alarmed U.S. and Western national security officials, as well as company executives who\r\nhave publicly come forward with their experiences after being duped.\r\nBeyond just earning a paycheck, placing North Korean operatives in technical roles at Western firms can also\r\nmake it easier to carry out hacking operations and cryptocurrency theft. In some cases, these workers have\r\ninstalled malicious software on company devices, stolen hundreds of thousands of dollars from companies and\r\nattempted to gain access to sensitive software building environments. Some executives suggest the issue is likely\r\nworse than the public understands, as the stigma of hiring a fraudulent employee still pushes companies to keep\r\nquiet.\r\nSouth Korea also accused its northern neighbor of playing an outsized role in global cryptocurrency theft. A 2024\r\nreport by a United Nations panel stated that it is investigating at least 58 cyberattacks by DPRK operatives against\r\ncryptocurrency companies between 2017 and 2023, with the incidents yielding an estimated $3 billion in stolen\r\ngains. The panel also investigated “reports of numerous Democratic People’s Republic of Korea nationals working\r\nhttps://cyberscoop.com/south-korea-sanctions-north-koreans-it-worker-scams/\r\nPage 1 of 2\n\noverseas earning income in violation of sanctions, including in the information technology, restaurant and\r\nconstruction sectors.”\r\nIn addition to threatening the overall cyber ecosystem, South Korea said the actions pose “a serious threat to\r\ninternational peace and security in that it is being used to fund North Korea’s nuclear and missile development.”\r\nSource: https://cyberscoop.com/south-korea-sanctions-north-koreans-it-worker-scams/\r\nhttps://cyberscoop.com/south-korea-sanctions-north-koreans-it-worker-scams/\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://cyberscoop.com/south-korea-sanctions-north-koreans-it-worker-scams/"
	],
	"report_names": [
		"south-korea-sanctions-north-koreans-it-worker-scams"
	],
	"threat_actors": [],
	"ts_created_at": 1775434740,
	"ts_updated_at": 1775791299,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/8e2cbb106393c53c29f52bcc66e87477af4411cb.pdf",
		"text": "https://archive.orkl.eu/8e2cbb106393c53c29f52bcc66e87477af4411cb.txt",
		"img": "https://archive.orkl.eu/8e2cbb106393c53c29f52bcc66e87477af4411cb.jpg"
	}
}