North Korean IT contractor found working remotely in New Zealand

A North Korean IT contractor employed a fictitious identity to secure remote work with a New Zealand firm, then threatened to disclose confidential information upon discovery, according to New Zealand's cybersecurity agency. The National Cyber Security Centre revealed that the individual was working remotely for a large New Zealand business, which began to doubt his genuine identity over time.

After an investigation, the agency confirmed the worker's North Korean origin. The North Korean employee utilized a fabricated persona, including a fabricated identity, New Zealand address, and enlisted a New Zealand citizen to manage the company's laptop. Upon learning the contractor's true identity, the company terminated their employment and refused to compensate for their services.

The worker subsequently claimed to have gained access to commercially sensitive information and threatened to release it unless paid. North Korea is subject to a series of international sanctions due to its weapons and nuclear programs, which prohibit its citizens from obtaining work visas abroad, among numerous other limitations.

In July, the United States and ten Asian and European allies cautioned businesses against hiring North Korean IT workers whose labor was yielding significant foreign currency to finance the country's nuclear weapons program. North Korea has vehemently denied these allegations. The report recommended that businesses conduct face-to-face interviews with potential contractors to mitigate the risk of clandestine activities.

The 48-page risk assessment indicated that 23% of major cyber attacks on New Zealand in the previous year were state-sponsored, specifically attributing attacks to China, Russia, Iran, and North Korea. The report also cautioned of an escalating risk to the South Pacific due to state-sponsored cyber espionage targeting governments and infrastructure in the region.