Pull to refresh
Logo
Australia sanctions North Koreans behind fraudulent IT worker schemes

Australia sanctions North Koreans behind fraudulent IT worker schemes

Rule Changes

Asset freezes and travel bans hit networks funnelling remote-work cash to Pyongyang's weapons programs

2 days ago: Australia sanctions two DPRK operatives, two companies

Overview

Updated 1 hour ago

Australia froze the assets of two North Korean operatives and two companies on October 23, 2026. They are accused of running a scheme that places fraudulent IT workers in remote jobs abroad to raise money for North Korea's weapons programs.

The two men also face travel bans. Anyone in Australia who deals with their assets without government permission faces up to 10 years in prison and fines of up to $910,000 for individuals, or $3.64 million for companies.

The action targets a revenue stream that violates UN Security Council resolutions banning North Korea's export of labour. Australia's sanctions office says North Korean workers have used stolen and doctored Australian drivers' licences and passports to win remote contracts, and that local firms have been approached through LinkedIn, Fiverr and Freelancer.

Why it matters

Australian companies have been unwittingly hiring North Korean IT workers using stolen identities — funding weapons programs and creating criminal exposure.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

2
Individuals sanctioned
Yu Pu Ung and Sim Hyon Sop face asset freezes and travel bans.
2
Companies sanctioned
Korea Mangyondae Computer Technology and Chinyong Information Technology.
$910K
Maximum individual fine
Or three times the transaction value, whichever is greater.
$3.64M
Maximum company fine
Companies can defend by showing reasonable precautions and due diligence.
10 yrs
Maximum prison term
For making assets available to a listed person or entity without authorisation.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

Sign up to generate historical perspectives on this story.

People Involved

Organizations Involved

Timeline

April 2023 October 2026

4 events Latest: 2 days ago
Tap a bar to jump to that date
  1. Australia sanctions two DPRK operatives, two companies

    Latest Sanctions

    Australia freezes assets of two DPRK operatives and two IT firms over fake worker schemes.

  2. US designates Mangyondae IT company

    Sanctions

    US Treasury designates Korea Mangyondae Computer Technology Company over IT worker delegations.

  3. US Treasury names Yu Pu Ung a DPRK finance linchpin

    Sanctions

    US Treasury describes the China-based Yu as a linchpin of North Korea's illicit money-making.

  4. US sanctions Sim Hyon Sop, DPRK banker in Dandong

    Sanctions

    US Treasury designates Sim, deputy representative of Korea Kwangson Banking Corp.

Scenarios

1

EU follows with matching sanctions on DPRK IT networks

Likely Resolves by Q2 2027

Discussed by: Foreign Minister Penny Wong said Australia acted in coordination with the European Union.

Wong's statement said the action was taken "in coordination with international partners, including the European Union." An EU listing of the same four targets would extend asset freezes across European banks and hiring platforms, squeezing the networks' access to European employers.

2

North Korean networks resurface under new front companies

Likely Resolves by Oct 23, 2027

Discussed by: The ASO advisory describes the networks' adaptive tactics; US Treasury has sanctioned successive DPRK front companies over the past years.

North Korean IT operations have survived prior sanctions by forming new front companies and moving workers between host countries. If the MSMT or US Treasury designates successor companies or new individuals connected to the Yu or Sim networks within a year, the resurfacing scenario holds.

3

First Australian firm convicted over DPRK IT worker payments

Possible Resolves by Q2 2028

Discussed by: The ASO advisory's warnings to businesses suggest heightened enforcement; penalties run to 10 years' jail for individuals.

The ASO told companies not to rely on recruiters' due diligence, signaling enforcement focus. A prosecution would require evidence that a company made assets available to a listed entity without taking reasonable precautions. A conviction would be the first test of the new listings in an Australian court.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

2023

Arizona laptop farm case (2023)

US federal prosecutors and the FBI exposed a "laptop farm" in Arizona where North Korean IT workers used networked laptops and false identities to pose as Americans and access US companies' systems remotely. The Justice Department documented the operation in court filings.

Then

The operation was dismantled and charges pursued against organizers.

Now

It became a reference point for how North Korean IT workers use fabricated identities to bypass employment checks.

Why this matters now

The Arizona case demonstrated the same identity-fraud mechanism Australia is now sanctioning, and it predated the US and Australian designations of the same networks.

December 2017

UN Security Council Resolution 2397 (2017)

UN Security Council Resolution 2397 required member states to repatriate all North Korean overseas workers by December 2019, cutting off a legal source of foreign currency for Pyongyang.

Then

North Korea lost its legal overseas labour force within two years.

Now

Pyongyang shifted to covert IT worker schemes using stolen identities, which the MSMT says continue despite UN sanctions.

Why this matters now

The fraudulent IT worker networks Australia sanctioned are an evasion of the UN labour ban. Australia's listings cite UN Security Council resolutions including 1718 and subsequent ones.

Sources

(7)