Expansion of North Korean IT Worker Operations into Europe

• •DPRK IT workers are expanding operations into Europe, posing as legitimate remote employees.
• •UK businesses in IT, crypto, and electronic payments are particularly at risk of infiltration.
• •Common tactics include false representation of identity and nationality to secure contracts.

The Google Threat Intelligence Group reported an increase in North Korean IT workers operating in Europe, expanding their activities beyond the United States. These workers pose as legitimate remote employees to infiltrate companies and generate revenue for the DPRK regime, raising risks of espionage and data theft. The advisory from the UK government highlights that these workers primarily operate from Russia and China, using various techniques to mask their true identities. The report indicates a notable rise in extortion campaigns and operations within corporate virtualized infrastructures. This expansion follows challenges faced by DPRK IT workers in the U.S. due to increased scrutiny and legal barriers. The advisory outlines specific signs and practices to watch for when engaging with potential DPRK workers.