Key points
- Australia has sanctioned two North Korean individuals, Yu Pu Ung and Sim Hyon Sop, and two companies, Korea Mangyongdae Computer Technology Company and Chinyong Information Technology Cooperation Company, over schemes placing IT workers in remote jobs abroad.
- The Australian Sanctions Office has warned that North Korean workers are using stolen and doctored Australian drivers’ licences and passports to win remote contracts.
- Breaching the sanctions by making an asset available to a listed person or entity carries penalties of up to 10 years’ jail and fines of up to $910,000 for individuals, or $3.64 million for companies.
Australia has imposed targeted financial sanctions and travel bans on two North Korean individuals and two companies that help the Pyongyang regime place IT workers in remote jobs abroad, so as to illicitly bring in foreign currency.
They are Yu Pu Ung, Sim Hyon Sop, Korea Mangyongdae Computer Technology Company and Chinyong Information Technology Cooperation Company.
All four were already under United States Treasury sanctions, which accuse them of running or bankrolling the schemes.
Mangyongdae runs IT worker delegations out of the Chinese cities of Shenyang and Dandong, iTnews reported when the US designated the company last November.
Chinyong uses a network of companies and representatives to manage teams of IT workers in Russia and Laos, US Treasury said.
Yu is said to be a China-based representative of North Korea’s Tanchon Bank.
He is alleged to have used funds from IT worker groups to supply weapons-related materials to the regime’s munitions makers, US Treasury said.
Meanwhile, Sim was sanctioned by the US in April 2023, when US Treasury described him as a deputy representative of the Korea Kwangson Banking Corp based in Dandong.
The US State Department has offered a US$7 million reward for information on Sim.
Good Australian salaries attract deceptive DPRK IT workers
The Australian government said the workers obtained remote employment while posing as nationals of other countries, breaching UN Security Council resolutions that prohibit North Korea’s export of labour.
“We are taking this action in coordination with international partners, including the European Union,” Foreign Minister Penny Wong said in a statement.
The listings act on findings by the Multilateral Sanctions Monitoring Team (MSMT), which the government said had exposed North Korea’s sanctions evasion networks and “the serious cyber security risks those networks pose to affected businesses”.
Today’s listings follow a warning from Australia’s Sanctions Office (ASO) that North Korean workers are using stolen and doctored Australian drivers’ licences and passports to win remote contracts.
In an advisory. the ASO said Australia’s competitive salaries and demand for contract IT staff made the country an attractive target for DPRK actors.
Local companies have been approached by North Korean IT workers through LinkedIn, Fiverr and Freelancer, as well as through recruitment firms, ASO said.
ASO told businesses not to rely on recruiters’ due diligence, and to watch for warning signs such as artificial intelligence-generated interview answers, face-swap filters on video calls and logins from several countries in quick succession.
Making an asset available to a listed person or entity without ministerial authorisation is a criminal offence under Australian sanctions law.
Individuals breaking the law face up to 10 years’ jail and fines of up to $910,000, or three times the value of the transactions, whichever is greater.
Companies face fines of up to $3.64 million on the same basis, though a business can defend itself by showing it took reasonable precautions and exercised due diligence.
Australia’s previous round of North Korean cyber sanctions last November targeted the regime’s hacking apparatus, which includes the Lazarus Group, its Andariel offshoot and the espionage-focused Kimsuky.
