https://www.bbc.com/news/articles/c15wk77zxngo Skip to content Watch Live * Home * News * Sport * Business * Innovation * Culture * Arts * Travel * Earth * Audio * Video * Live * Home * News + Israel-Gaza War + War in Ukraine + US & Canada + UK o UK Politics o England o N. Ireland # N. Ireland Politics o Scotland # Scotland Politics o Wales # Wales Politics + Africa + Asia o China o India + Australia + Europe + Latin America + Middle East + In Pictures + BBC InDepth + BBC Verify * Sport * Business + Executive Lounge + Technology of Business + Future of Business * Innovation + Technology + Science & Health + Artificial Intelligence + AI v the Mind * Culture + Film & TV + Music + Art & Design + Style + Books + Entertainment News * Arts + Arts in Motion * Travel + Destinations o Africa o Antarctica o Asia o Australia and Pacific o Caribbean & Bermuda o Central America o Europe o Middle East o North America o South America + World's Table + Culture & Experiences + Adventures + The SpeciaList * Earth + Natural Wonders + Weather & Science + Climate Solutions + Sustainable Business + Green Living * Audio + Podcasts + Radio + Audio FAQs * Video * Live + Live News + Live Sport [ ] Home News Sport Business Innovation Culture Arts Travel Earth Audio Video Live Weather Newsletters Watch Live North Korea sent me abroad to be a secret IT worker. My wages funded the regime 24 hours ago ShareSave Beth Godwin and Julie Yoonnyung Lee BBC Trending & BBC News ShareSave [grey-place]Getty Images A graphic showing a man in a cap and uniform working on a laptop with a North Korean flag as a backgroundGetty Images Jin-su says over the years he used hundreds of fake IDs to apply for remote IT work with Western companies. It was part of a vast undercover scheme to raise funds for North Korea. Juggling multiple jobs across the US and Europe would make him at least $5,000 (PS3,750) a month, he told the BBC in a rare interview. Some colleagues, he said, would earn much more. Before he defected, Jin-su - whose name has been changed to protect his identity - was one of thousands believed to have been sent abroad to China and Russia, or countries in Africa and elsewhere, to take part in the shadowy operation run by secretive North Korea. North Korean IT workers are closely monitored and few have spoken to the media, but Jin-su has provided extensive testimony to the BBC, giving a revealing insight into what daily life is like for those working the scam, and how they operate. His first-hand account confirms much of what has been estimated in UN and cyber security reports. He said 85% of what he earned was sent back to fund the regime. Cash-strapped North Korea has been under international sanctions for years. "We know it's like robbery, but we just accept it as our fate," Jin-su said, "it's still much better than when we were in North Korea." Secret IT workers generate $250m-$600m annually for North Korea, according to a UN Security Council report published in March 2024. The scheme boomed in the pandemic, when remote working became commonplace, and has been on the rise ever since, authorities and cyber defenders warn. Most workers are after a steady paycheck to send back to the regime, but in some cases, they have stolen data or hacked their employers and demanded ransom. Last year, a US court indicted 14 North Koreans who allegedly earned $88m by working in disguise and extorting US firms over a six-year period. Four more North Koreans who allegedly used fraudulent identities to secure remote IT work for a cryptocurrency firm in the US were indicted last month. US woman gets 8-year sentence for stealing identities to give North Koreans jobs Firm hacked after accidentally hiring North Korean cyber criminal Getting the jobs Jin-su was an IT worker for the regime in China for several years before defecting. He and his colleagues would mostly work in teams of 10, he told the BBC. Access to the internet is limited in North Korea, but abroad, these IT workers can operate more easily. They need to disguise their nationality not just because they can get paid more by impersonating Westerners, but due to the extensive international sanctions North Korea is under, primarily in response to its nuclear weapons and ballistic missile programmes. This scheme is separate from North Korea's hacking operations which also raise money for the regime. Earlier this year the Lazarus Group - an infamous hacking group understood to be working for North Korea, though they've never admitted to it - is thought to have stolen $1.5bn (PS1.1bn) from cryptocurrency firm Bybit. [grey-place]A woman smiles at a laptop - she is speaking to someone on a video call. Another woman looks at her. The BBC spoke to Jin-su on a video call from London. For his safety we are protecting his identity. Jin-su spent most of his time trying to secure fraudulent identities which he could use to apply for jobs. He would first pose as Chinese, and contact people in Hungary, Turkey and other countries to ask them to use their identity in exchange for a percentage of his earnings, he told the BBC. "If you put an 'Asian face' on that profile, you'll never get a job." He would then use those borrowed identities to approach people in Western Europe for their identities, which he'd use to apply for jobs in the US and Europe. Jin-su often found success targeting UK citizens. "With a little bit of chat, people in the UK passed on their identities so easily," he said. Listen to BBC Trending: Could your colleague be a North Korean in disguise? IT workers who speak better English sometimes handle the applications process. But jobs on freelancer sites also don't necessarily require face-to-face interviews, and often day-to-day interactions take place on platforms like Slack, making it easier to pretend to be someone you are not. Jin-su told the BBC he mostly targeted the US market, "because the salaries are higher in American companies". He claimed so many IT workers were finding jobs, often companies would unwittingly hire more than one North Korean. "It happens a lot," he said. It's understood that IT workers collect their earnings through networks of facilitators based in the West and China. Last week a US woman was sentenced to more than eight years in prison for crimes connected to assisting North Korean IT workers find jobs and sending them money. The BBC cannot independently verify the specifics of Jin-su's testimony, but through PSCORE, an organisation which advocates for North Korean human rights, we've read testimony from another IT worker who defected that supports Jin-su's claims. The BBC also spoke to a different defector, Hyun-Seung Lee, who met North Koreans working in IT while he was travelling as a businessman for the regime in China. He confirmed they'd had similar experiences. A growing problem The BBC spoke to multiple hiring managers in the cyber security and software development sector who say they've spotted dozens of candidates they suspect are North Korean IT workers during their hiring processes. Rob Henley, co-founder of Ally Security in the US, was recently hiring for a series of remote vacancies at his firm, and believes he interviewed up to 30 North Korean IT workers in the process. "Initially it was like a game to some extent, like trying to figure out who was real and who was fake, but it got pretty annoying pretty quickly," he said. Eventually, he resorted to asking candidates on video calls to show him it was daytime where they were. "We were only hiring candidates from the US for these positions. It should have been at least light outside. But I never saw daylight." Back in March, Dawid Moczadlo, co-founder of Vidoc Security Lab based in Poland, shared a video of a remote job interview he conducted where the candidate appeared to be using artificial intelligence software to disguise their face. He said that after speaking to experts, he believed the candidate could be a North Korean IT worker. [grey-place]A screenshot of a video interview with two men wearing headphones. Dawid Moczadlo, co-founder of Vidoc Security Lab (right) interviews a candidate (left) that appears to be using AI software to disguise their face. Get Real Security - a digital forensics company - told us it's highly likely the candidate (left) is using some kind of faceswapping or AI filter We contacted the North Korean embassy in London to put the allegations in this story to them. They did not respond. A rare escape route North Korea has been sending its workers abroad for decades to earn the state foreign currency. Up to 100,000 are employed abroad as factory or restaurant workers, mostly in China and Russia. After several years of living in China, Jin-su said the "sense of confinement" over his oppressive working conditions built up. "We weren't allowed to go out and had to stay indoors all the time" he said. "You can't exercise, you can't do what you want." However, North Korean IT workers have more freedom to access Western media when they're abroad, Jin-su said. "You see the real world. When we are abroad, we realise that something is wrong inside North Korea." But despite this, Jin-su claimed few North Korean IT workers thought about escaping like he did. "They just take the money and go back home, very few people would think about defection." Although they only keep a small proportion of what they earn, it's worth a lot in North Korea. Defecting is also hugely risky and difficult. Surveillance in China means most are caught. Those few who do succeed in defecting may never see their families again, and their relatives could face punishment for them leaving. Jin-su is still working in IT now he's defected. He says the skills he honed working for the regime have helped him settle into his new life. Because he isn't working multiple jobs with fake IDs, he earns less than when he worked for the North Korean regime. But because he can keep more of his earnings, overall, he has more money in his own pocket. "I had got used to making money by doing illegal things. But now I work hard and earn the money I deserve." More Weekend Picks North Korea's Benidorm-style resort welcomes first Russian tourists A puff on a joint - then six months of forced rehab in a concrete cell Inside the abandoned homes of Assad's ruthless enforcers Recruitment North Korea Cyber-security Technology --------------------------------------------------------------------- Related Kenya signs Crown dependencies recruitment deal 'No discrimination' over police applicants - mayor Civil Service recruitment freeze extended --------------------------------------------------------------------- More from the BBC 19 hrs ago [grey-place]Alex waiting outside a bar with a cocktail I've seen her name and photo - but we can't talk before the date. Will it work out? Jaded by online dating fatigue, reporter Alex Taylor hopes to meet the future love of his life. 19 hrs ago 24 hrs ago [grey-place]A Tesla logo is red with a black background Tesla found partly to blame for fatal Autopilot crash The company's self-driving technology failed to prevent a 2019 crash which killed a 22-year-old woman and severely injured her boyfriend in Florida. 24 hrs ago 1 day ago [grey-place]Two women pose for selfies as they visit the disused Gyeonghwa Station railway track during the Jinhae Cherry Blossom Festival in Changwon Tech manufacturing has powered Asia - now it's a casualty of Trump's tariffs Trump's tariffs in his first term took aim at China - but this time they are going beyond. 1 day ago 1 day ago [grey-place]Two astronauts, one man and one woman, sit in full uniform aboard a rocket, facing upwards. Watch: SpaceX and Nasa launch crew headed to the ISS The four-person crew, who launched a day late due to weather, will relieve members of the previous SpaceX mission onboard the station. 1 day ago 2 days ago [grey-place]An image of a rocket launching sits next to an image of a night sky with three lights in the sky at sunset. Watch: 'UFO' spotted in Australian skies identified as Chinese rocket Astrophysicists said that the unusual lights spotted over Brisbane were tied to a satellite launch from China. 2 days ago --------------------------------------------------------------------- * Home * News * Sport * Business * Innovation * Culture * Arts * Travel * Earth * Audio * Video * Live * Weather * BBC Shop * BritBox BBC in other languages Follow BBC on: * Terms of Use * About the BBC * Privacy Policy * Cookies * Accessibility Help * Contact the BBC * Advertise with us * Do not share or sell my info * BBC.com Help & FAQs * Archive Copyright 2025 BBC. All rights reserved. The BBC is not responsible for the content of external sites. Read about our approach to external linking.