For years, North Korean IT worker schemes primarily targeted large technology companies. That’s changed. UK government and law enforcement intelligence from early 2026 indicates that small businesses — particularly those with five or fewer employees — have become primary targets. The scheme is sophisticated, the workers are technically capable, and by the time most employers realise something is wrong, sensitive code, credentials, or intellectual property has already left the building.

The UK’s Office of Financial Sanctions Implementation (OFSI) has issued advisories and taken sanctions action against individuals linked to DPRK (North Korean) IT worker networks. This is no longer a distant threat — it’s one with regulatory consequences for UK employers who unknowingly facilitate it.

How the Scheme Works

North Korean IT workers use AI-generated profiles, fabricated CVs, and sometimes stolen identities to present as qualified software developers, data scientists, or IT specialists based in the EU, UK, or US. They apply for remote contract or employment roles, pass technical interviews (they are genuinely skilled), and begin work.

The initial objective is salary diversion — sending their UK earnings back to North Korea via money transfer networks, sometimes using front companies or third-party payment facilitators. OFSI guidance notes this revenue funds North Korea’s weapons programmes.

The scheme has evolved. More recent incidents documented by US authorities and referenced in OFSI advisories show that workers who gain initial access are now also:

  • Exfiltrating intellectual property: Source code, client lists, proprietary algorithms
  • Installing persistence mechanisms: Backdoors or remote access tools in the codebases they work on
  • Conducting extortion: Threatening to publish stolen code or report the employer to data protection authorities if payments aren’t made

The shift to malware deployment and extortion means the risk is no longer limited to salary fraud. An employer who hires a DPRK IT worker may end up with a compromised codebase and a demand for cryptocurrency.

Why Small Businesses Are Targeted

Large companies have HR processes, identity verification, and background check infrastructure that creates friction. A 3-person agency or a 10-person SaaS startup hiring a contract developer through an online platform often has none of these.

The characteristics that make small businesses more vulnerable:

  • No HR function: Hiring decisions made by founders or technical leads who haven’t encountered this threat before
  • Remote-first hiring: Comfortable hiring internationally without video verification or in-person meeting
  • Platform-mediated contracts: Using Upwork, Toptal, or similar platforms where the platform’s identity verification is trusted as sufficient
  • Faster hiring timelines: Less time for due diligence under pressure to fill roles
  • Smaller teams mean higher access: A contract developer at a 5-person company may quickly have access to all source code, customer data, and infrastructure credentials

Warning Signs

None of these are individually conclusive, but clusters of them are worth investigating:

Identity inconsistencies

  • Profile photos that look AI-generated (reverse image search returns nothing; facial features are unnaturally symmetrical)
  • GitHub profile, LinkedIn history, or portfolio that doesn’t quite fit together chronologically
  • CV showing rapid progression through companies that are hard to verify

Video call behaviour

  • Reluctance to appear on video
  • Video that appears pre-recorded or that doesn’t respond naturally (latency inconsistencies, lighting that doesn’t change)
  • Background that looks like a studio or that changes between calls
  • Audio quality inconsistent with claimed location

Device and payment anomalies

  • Requests to use their own devices rather than company-issued hardware
  • Bank account in a different country to their claimed location, or requests to be paid via cryptocurrency or third-party payment platforms
  • VPN use from unexpected locations (login locations don’t match claimed timezone)

Work behaviour

  • Access requests beyond what the role requires, or early requests for elevated privileges
  • Code commits at unusual hours inconsistent with claimed timezone
  • Resistance to standard code review processes or to screen-sharing during work sessions

What to Do Before You Hire

Identity verification beyond a CV

  • Video interview with camera on, requesting them to show government-issued ID on camera
  • LinkedIn reference check: contact references directly via LinkedIn, not via contact information provided on the CV
  • GitHub/portfolio review: look for realistic contribution history, commit timestamps consistent with claimed location, interaction with recognisable community members

Contractual protections

  • Require contractors to work on company-issued devices for any work involving production access or proprietary code
  • UK-entity invoicing requirement: if hiring internationally, require invoicing through a registered entity in the contractor’s stated country
  • IP assignment clause: ensure all work product is assigned to the company

Access controls

  • Segment contractor access: contractors should not have access to production systems, customer data, or infrastructure credentials until a trust baseline is established
  • Monitor access logs: know when accounts are active and from what IP addresses
  • Require MFA on all company systems

If You’ve Already Hired Someone Suspicious

Do not confront the person directly or terminate access abruptly — this can trigger an immediate escalation (data exfiltration, credential abuse) before you’ve had time to investigate.

  1. Preserve evidence: Document what access they have, when they’ve used it, and any anomalous behaviour
  2. Rotate credentials quietly: Begin rotating credentials and removing access in a way that looks like a normal security refresh rather than a targeted action
  3. Audit their code contributions: Review all code they’ve committed for backdoors, hardcoded credentials, or unusual dependencies
  4. Contact Action Fraud: Report to Action Fraud (UK’s national fraud reporting centre) at actionfraud.police.uk, and contact OFSI if you believe sanctions have been breached
  5. Legal advice: If data was exfiltrated, you may have ICO reporting obligations under GDPR — get legal advice promptly

The Regulatory Dimension

UK sanctions regulations prohibit making funds available, directly or indirectly, to sanctioned individuals or entities. If you’re paying a DPRK IT worker — even unknowingly — you may be in breach of sanctions regulations. OFSI has a general licence for certain inadvertent payments but the conditions are specific.

The practical upshot: if you discover you’ve hired a DPRK-linked contractor, you need legal advice quickly, and you need to self-report to OFSI. Voluntary disclosure is treated more favourably than enforcement-triggered discovery.

References