PoliticsNorth Korea has continuously deployed a network of remote IT workers to defraud businesses and transfer revenues toward the proliferation of nuclear weapons, says a statement by Global Affairs Canada and its counterparts in nine other countries.Joint alert says scheme is used by regime to finance weapons of mass destructionDavid Cummings · CBC News · Posted: Jul 31, 2026 3:24 PM EDT | Last Updated: 1 hour agoListen to this articleEstimated 5 minutesThe audio version of this article is generated by AI-based technology. Mispronunciations can occur. We are working with our partners to continually review and improve the results.People pay their respects on the 32nd anniversary of the death of the late communist leader Kim Il-Sung, in Pyongyang, North Korea, on July 8. Global Affairs Canada and counterparts from nine other countries published an alert on Friday about North Korea's IT worker scheme. (Jon Chol Jin/The Associated Press)Canada and multiple allies released an alert on Friday detailing a North Korean scheme to fund its weapons of mass destruction program.According to the joint statement released by Global Affairs Canada (GAC) and its counterparts in Japan, the U.S., the U.K. and a half-dozen other countries, North Korea has continuously deployed a network of remote IT workers to defraud businesses and transfer revenues toward the proliferation of nuclear weapons.The individuals within the network impersonate workers from other countries to obtain work and income with private companies, then remit their salaries to their parent North Korean agencies, the statement said.Those funds are then used to expand North Korea's nuclear weapons arsenal, according to the Financial Action Task Force (FATF), an independent, intergovernmental anti-money laundering and counterterrorist financing watchdog.The FATF has put North Korea on its "black list" as a high-risk jurisdiction, meaning the organization calls on all countries to deploy such countermeasures as terminating relationships with North Korean banks and limiting business relationships and transactions with North Korean nationals.WATCH | North Korea shows off new missiles:North Korea flaunts new missiles in military paradeOctober 11, 2025|Duration 0:34North Korean leader Kim Jong-un unveiled a new intercontinental ballistic missile at a massive military parade marking 80 years of the ruling party.Following a 2017 United Nations resolution, all member countries are required to repatriate any North Korean nationals earning income within their borders back to North Korea, with few exceptions.Canada, along with France, Germany, Italy, Japan, South Korea, the Netherlands, New Zealand, the U.K. and the U.S., urged countries and companies to better understand North Korea's scheme and to deploy effective countermeasures against the illicit network.It's not the first time Canada has issued an advisory about the risks posed by North Korea's IT worker scheme."Our countries have repeatedly issued information to warn the international community and private sector of the threat posed by North Korean IT workers," the joint statement reads. "We continue to actively monitor and counter the North Korean IT worker threat."How does the scheme work?The North Korean workers deployed to carry out the regime's plot are typically highly skilled in IT-related work and look for jobs and contracts in areas like web page development, mobile applications, software and blockchain applications, the statement says.They often obtain work in foreign countries by falsifying their nationality or identity through a few common methods.The scheme is also "increasingly likely" to involve proxy agents from third countries, according to the alert. That might mean using their identification documents to forge online accounts, but it can go so far as to have the proxy participate in job interviews and establish in-person contact to create a false sense of trust with the company.GAC and its counterparts said the workers in the network generally reside in North Korea, China and Russia, as well as in Southeast Asian and African countries, using third-party proxies, VPNs and other tools to conceal the fact they are working from abroad.The schemes may also involve "laptop farms," which make use of company-provided laptops that are then accessed remotely by North Korean IT workers to cover their true location.A TV screen shows an image of North Korean leader Kim Jong-un during a news program airing at a railway station in Seoul, South Korea, on Feb. 26. (Ahn Young-joon/The Associated Press)Identifying a North Korean agentGAC and its counterparts provided a list of behaviours and characteristics often exhibited by workers involved in North Korean IT schemes.They suggested web companies keep an eye out for certain behaviour, including frequent changes to registered information like account and banking details; multiple accounts created using the same identification document and accessed from the same IP address; a single account accessed from multiple IP addresses within a short period of time; and an account remains logged in for an unusually long period of time.For companies hiring, some of the flagged behaviours include refusing to participate in video calls; video call discrepancies like photo ID mismatches or video feeds that seem manipulated or artificially generated; requesting payments in cryptocurrency; and signs the account is being operated by multiple people.GAC and its counterparts said if multiple behaviours relate to someone applying for work, it's possibly a North Korean IT worker fraudulently seeking employment."North Korean IT workers often operate in teams, and the individual whom a hiring or procuring official interacts with may change depending on the time of day," the statement reads.Big payouts toward North Korean weaponsAccording to the U.S. Treasury Department, North Korean IT worker schemes defrauded American businesses and generated $800 million US in 2024.In April, two Americans were sentenced to prison for participating a plot that generated $5 million. Typical of the scheme, it involved a laptop farm operated by the two Americans, accessed remotely by a team of North Korean workers to extract income.In that particular case, North Korean IT workers made use of at least 80 stolen U.S. identities to fraudulently obtain work at more than 100 American companies.By generating funds through a network of illicit workers extracting income from companies globally, North Korea continues to finance its proliferation of weapons of mass destruction, according to the statement.In March, North Korean leader Kim Jong-un promised to expand the regime's nuclear arsenal, and just last month his sister, Kim Yo-jong, said North Korea will never back down from its status as a country militarized by nuclear weapons.WATCH | North Korea launches missile from a train:North Korean TV shows off missile launchSeptember 16, 2021|Duration 0:32North Korea says it successfully launched ballistic missiles from a train for the first time, in an apparent attempt to diversify launch options.