On 30 March the Department of Foreign Affairs and Trade, and the United States Department of State, in partnership with Global Affairs Canada, DTEX and Mandiant, convened a symposium entitled Protecting Industry from North Korean Threats in Sydney.

The threat posed by Democratic People's Republic of Korea (DPRK) information technology (IT) workers has grown significantly in scale and sophistication. DPRK IT workers pose as legitimate remote professionals to infiltrate private sector organisations, generating revenue for the DPRK government and, in some cases, conducting malicious cyber activity. It is estimated DPRK cyber actors and IT workers have stolen over USD 2.8 billion in cryptocurrency since January 2024 and earned an estimated USD 300-800 million in revenue in 2024, enabling the financing of the DPRK’s weapons of mass destruction (WMD) and ballistic missile programs in violation of UN Security Council sanctions.

DPRK IT workers employ increasingly deceptive tactics, including the use of fabricated identities, fraudulent credentials, and AI-generated personas to secure remote employment. Once hired, they may access sensitive corporate systems, steal intellectual property, and extort their employers.

In response to these threats, the United States and Australia, with support from Canada, convened government officials together with industry leaders, including DTEX and Mandiant. Over 80 professionals from Australia’s technology sector, recruiting and staffing companies, and financial services examined DPRK IT worker tactics, shared best practices, and discussed public-private sector collaboration strategies to detect and mitigate these threats.

Information is available at the following government advisory: Australian Sanctions Office Advisory Note on Risks of DPRK IT Workers.