Advisory on North Korean information technology (IT) workers

Summary

The Royal Canadian Mounted Police, together with Public Safety Canada, Global Affairs Canada, FINTRAC and the Canadian Centre for Cyber Security, have issued an advisory warning Canadians and Canadian businesses about the risks of hiring IT workers deployed by the North Korean government (DPRK).

These state-affiliated IT workers often pose as legitimate freelancers based in other countries and offer services such as mobile/web development, gaming and online gambling development, IT support, graphic animation, database and platform development, and hardware/firmware work. They tend to be skilled and competent, but may use VPNs, VPSs, VOIP and encrypted messaging, AI deepfakes, and proxies to hide their true identities and build access to networks for future malicious activity.

Key Points

Hiring DPRK-affiliated IT workers can breach Canadian sanctions under the United Nations Act and the Special Economic Measures Act, exposing individuals and businesses to criminal penalties (fines and/or imprisonment).
North Korean IT workers may insert passive malware or backdoors, enabling data theft, corporate espionage and future exploitation of corporate networks and critical infrastructure.
They commonly disguise their origins using VPNs/VPSs, deepfakes, proxies and multiple account logins across different IP addresses.
Red flags include requests for cryptocurrency payments, frequent transfers via online payment platforms, inconsistent biographical details, refusal/inability to provide ID or take part in voice/video calls, unusually low bids, and multiple log-ins from different countries.
Mitigation steps: avoid crypto payments, scrutinise documentation, conduct in-person or robust video interviews (and test for deepfakes), verify credentials and references, and report suspicious transactions or activity to FINTRAC, RCMP and relevant government contacts.
Small businesses and start-ups are especially vulnerable due to their need for affordable skilled labour and often limited vetting resources.

Context and relevance

North Korea has prioritised science and technology education, producing a skilled IT workforce that the state may deploy abroad to generate revenue and obtain technical advantages for its weapons programmes. International partners have observed DPRK-linked cyber activities including large-scale cryptocurrency thefts and sophisticated sanctions-evasion tactics. For Canadian organisations this advisory ties legal risk (sanctions contravention), financial risk (money laundering and sanctions evasion) and cybersecurity risk (espionage, data theft) into one clear warning.

Why should I read this?

Look — if you hire freelancers or offshore IT help, skim this now. It tells you what to watch for, what not to pay for (hint: crypto payments), and why getting sloppy could land you in legal and cyber trouble. Saves you time and a potential nightmare.

Source

Source: https://rcmp.ca/en/news/2025/07/advisory-north-korean-information-technology-it-workers