The threat posed by Democratic People’s Republic of Korea (DPRK) information technology (IT) workers has grown significantly in scale and sophistication in recent years. In response in late March the United States Department of State and the Australian Government Department of Foreign Affairs and Trade, in partnership with Global Affairs Canada, DTEX, and Mandiant, convened a symposium entitled Protecting Industry from North Korean Threats in Sydney, Australia.
DPRK IT workers pose as legitimate remote professionals to infiltrate private sector organisations, generating revenue for the DPRK government and, in some cases, conducting malicious cyber activity. The Multilateral Sanctions Monitoring Team (MSMT) estimated in the October 2025 report that DPRK cyber actors and IT workers have stolen over $2.8 billion in cryptocurrency since January 2024 and earned an estimated $350-800 million in revenue in 2024, enabling the financing of the DPRK’s weapons of mass destruction (WMD) and ballistic missile programs in violation of UN Security Council sanctions.
DPRK IT workers employ increasingly deceptive tactics, including the use of fabricated identities, fraudulent credentials, and AI-generated personas to secure remote employment. Once hired, they may access sensitive corporate systems, steal intellectual property, and extort their employers.
In response to these threats, the United States and Australia with support from Canada convened government officials together with industry leaders in the fight against these threats, including DTEX and Mandiant. Over 80 professionals from Australia’s technology sector, recruiting and staffing companies, and financial services examined DPRK IT worker tactics, shared best practices, and discussed public-private sector collaboration strategies to detect and mitigate these threats.
For Editorial Inquiries Contact:
Editor Kym Bergmann at [email protected]
For Advertising Inquiries Contact:
Group Sales Director Simon Hadfield at [email protected]
