Police Probe Suspected North Korean IT Worker at South Korean Company

South Korean police are investigating a suspected North Korean information technology worker who allegedly secured work at a domestic private company under a false identity, in what authorities describe as the first such case publicly disclosed in the country.

Police said they detected the suspected employment case last year. The individual reportedly performed software development work for the company, although authorities have not identified the employer or disclosed how long the arrangement lasted. Investigators are now tracing the amount and route of payments and examining whether other people or an organized network were involved.

The inquiry brings a threat more commonly associated with overseas remote hiring into South Korea’s own labor market. North Korean technology workers have been accused of posing as nationals of other countries to obtain freelance contracts and full-time jobs through online recruiting, procurement and service platforms. Their earnings are believed to provide revenue to the North Korean government, while their access to company systems can create additional security risks.

A joint alert issued in July by 11 countries, including South Korea, the United States and Japan, warned that such workers were using increasingly sophisticated methods to conceal their identities and locations. The advisory said artificial intelligence could help applicants improve false profiles or evade screening. It also warned that workers with internal access could steal data, cryptocurrency or other sensitive information.

The South Korean investigation follows a major enforcement action in the United States against alleged remote-employment fraud linked to North Korea. U.S. authorities said this month that they had searched more than 40 suspected “laptop farm” locations in Texas and seized about 187 laptops and other devices. Such operations can place company-issued computers at domestic addresses, allowing workers abroad to connect remotely while appearing to employers to be based locally. More than 70 U.S. companies were identified as victims in that case.

The newly disclosed South Korean case could test how effectively domestic employers verify remote applicants and monitor access to sensitive corporate systems. It also raises questions about whether salary payments passed through intermediaries or financial channels designed to disguise the ultimate recipient.

Police have not announced any arrest or final determination, and the worker remains described as a suspect. The investigation is continuing into the employment arrangement, payment trail and any possible links to a broader network.