North Korea sent me abroad to be a secret IT worker. My wages funded the regime

Jin-su says over the years he used hundreds of fake IDs to apply for remote IT work with Western companies. It was part of a vast undercover scheme to raise funds for North Korea.

Juggling multiple jobs across the US and Europe would make him at least $5,000 (£3,750) a month, he told the BBC in a rare interview. Some colleagues, he said, would earn much more.

Before he defected, Jin-su - whose name has been changed to protect his identity - was one of thousands believed to have been sent abroad to China and Russia, or countries in Africa and elsewhere, to take part in the shadowy operation run by secretive North Korea.

North Korean IT workers are closely monitored and few have spoken to the media, but Jin-su has provided extensive testimony to the BBC, giving a revealing insight into what daily life is like for those working the scam, and how they operate. His first-hand account confirms much of what has been estimated in UN and cyber security reports.

He said 85% of what he earned was sent back to fund the regime. Cash-strapped North Korea has been under international sanctions for years.

"We know it's like robbery, but we just accept it as our fate," Jin-su said, "it's still much better than when we were in North Korea."

Secret IT workers generate $250m-$600m annually for North Korea, according to a UN Security Council report published in March 2024. The scheme boomed in the pandemic, when remote working became commonplace, and has been on the rise ever since, authorities and cyber defenders warn.

Most workers are after a steady paycheck to send back to the regime, but in some cases, they have stolen data or hacked their employers and demanded ransom.

Last year, a US court indicted 14 North Koreans who allegedly earned $88m by working in disguise and extorting US firms over a six-year period.

Four more North Koreans who allegedly used fraudulent identities to secure remote IT work for a cryptocurrency firm in the US were indicted last month.

Jin-su was an IT worker for the regime in China for several years before defecting. He and his colleagues would mostly work in teams of 10, he told the BBC.

Access to the internet is limited in North Korea, but abroad, these IT workers can operate more easily. They need to disguise their nationality not just because they can get paid more by impersonating Westerners, but due to the extensive international sanctions North Korea is under, primarily in response to its nuclear weapons and ballistic missile programmes.

This scheme is separate from North Korea's hacking operations which also raise money for the regime. Earlier this year the Lazarus Group - an infamous hacking group understood to be working for North Korea, though they've never admitted to it - is thought to have stolen $1.5bn (£1.1bn) from cryptocurrency firm Bybit.

Jin-su spent most of his time trying to secure fraudulent identities which he could use to apply for jobs. He would first pose as Chinese, and contact people in Hungary, Turkey and other countries to ask them to use their identity in exchange for a percentage of his earnings, he told the BBC.

"If you put an 'Asian face' on that profile, you'll never get a job."

He would then use those borrowed identities to approach people in Western Europe for their identities, which he'd use to apply for jobs in the US and Europe. Jin-su often found success targeting UK citizens.

"With a little bit of chat, people in the UK passed on their identities so easily," he said.

IT workers who speak better English sometimes handle the applications process. But jobs on freelancer sites also don't necessarily require face-to-face interviews, and often day-to-day interactions take place on platforms like Slack, making it easier to pretend to be someone you are not.

Jin-su told the BBC he mostly targeted the US market, "because the salaries are higher in American companies". He claimed so many IT workers were finding jobs, often companies would unwittingly hire more than one North Korean. "It happens a lot," he said.

It's understood that IT workers collect their earnings through networks of facilitators based in the West and China. Last week a US woman was sentenced to more than eight years in prison for crimes connected to assisting North Korean IT workers find jobs and sending them money.

The BBC cannot independently verify the specifics of Jin-su's testimony, but through PSCORE, an organisation which advocates for North Korean human rights, we've read testimony from another IT worker who defected that supports Jin-su's claims.

The BBC also spoke to a different defector, Hyun-Seung Lee, who met North Koreans working in IT while he was travelling as a businessman for the regime in China. He confirmed they'd had similar experiences.

The BBC spoke to multiple hiring managers in the cyber security and software development sector who say they've spotted dozens of candidates they suspect are North Korean IT workers during their hiring processes.

Rob Henley, co-founder of Ally Security in the US, was recently hiring for a series of remote vacancies at his firm, and believes he interviewed up to 30 North Korean IT workers in the process. "Initially it was like a game to some extent, like trying to figure out who was real and who was fake, but it got pretty annoying pretty quickly," he said.

Eventually, he resorted to asking candidates on video calls to show him it was daytime where they were.

"We were only hiring candidates from the US for these positions. It should have been at least light outside. But I never saw daylight."

Back in March, Dawid Moczadło, co-founder of Vidoc Security Lab based in Poland, shared a video of a remote job interview he conducted where the candidate appeared to be using artificial intelligence software to disguise their face. He said that after speaking to experts, he believed the candidate could be a North Korean IT worker.

North Korea has been sending its workers abroad for decades to earn the state foreign currency. Up to 100,000 are employed abroad as factory or restaurant workers, mostly in China and Russia.

After several years of living in China, Jin-su said the "sense of confinement" over his oppressive working conditions built up.

"We weren't allowed to go out and had to stay indoors all the time" he said. "You can't exercise, you can't do what you want."

However, North Korean IT workers have more freedom to access Western media when they're abroad, Jin-su said. "You see the real world. When we are abroad, we realise that something is wrong inside North Korea."

But despite this, Jin-su claimed few North Korean IT workers thought about escaping like he did.

"They just take the money and go back home, very few people would think about defection."

Although they only keep a small proportion of what they earn, it's worth a lot in North Korea. Defecting is also hugely risky and difficult. Surveillance in China means most are caught. Those few who do succeed in defecting may never see their families again, and their relatives could face punishment for them leaving.

Jin-su is still working in IT now he's defected. He says the skills he honed working for the regime have helped him settle into his new life.

Because he isn't working multiple jobs with fake IDs, he earns less than when he worked for the North Korean regime. But because he can keep more of his earnings, overall, he has more money in his own pocket.

"I had got used to making money by doing illegal things. But now I work hard and earn the money I deserve."