Australia adds sanctions as North Korean IT workers target remote jobs

The friendly remote developer who quotes low, never turns on the camera and wants paying in crypto may be working for North Korea. Hire one, and your business could breach sanctions law.

Australia has now added four more names to its North Korea sanctions. The Department of Foreign Affairs and Trade (DFAT) announced the listing on 23 October 2026.

Who has been listed

The four new names on DFAT’s Consolidated List are:

• Yu Pu Ung
• Sim Hyon Sop
• Korea Mangyondae Computer Technology Company
• Chinyong Information Technology Cooperation Company

All four face targeted financial sanctions. The two individuals are also banned from travelling to, entering or staying in Australia.

DFAT’s notice doesn’t describe their roles. iTnews reports that they run or finance the schemes that place North Korean IT workers in remote jobs abroad. It says the United States had already sanctioned all four.

The risk was already there

The new names don’t create the risk for Australian businesses. They add to it.

DFAT’s Australian Sanctions Office warned in its July advisory that paying a North Korean IT worker can already breach Australian sanctions law. Its pay can end up with a sanctioned person, or count as prohibited business with North Korea. The new listing makes it an offence to make any asset available, directly or indirectly, to these four without the Minister’s permission.

The office says North Korea has sent thousands of skilled IT workers around the world, posing as other nationalities to win remote work. Their pay helps fund North Korea’s weapons programs.

Australia is an attractive target because of good pay and strong demand for contract IT professionals. The workers take on website design, graphic design and general programming. Australian companies have been approached through LinkedIn, Fiverr, Freelancer and formal recruitment firms. Some workers have used stolen and doctored Australian driver’s licences and passports.

The risk isn’t only legal. Hiring one can lead to stolen data and intellectual property, improper access to personal details and funds, and damage to your reputation.

What the penalties are

The office’s advisory is written to help businesses avoid hiring a North Korean IT worker by accident. The maximum penalties are steep:

• Individuals: up to 10 years in prison and/or a fine of up to $910,000. The fine can instead be three times the transaction value, if that’s greater.
• Companies: a fine of up to $3.64 million, or three times the transaction value, whichever is greater.

Companies have a defence if they can prove they took reasonable precautions and exercised due diligence. Following the advisory can help show that.

Businesses trying to do the right thing usually get education and guidance, though serious cases can be prosecuted. If the office contacts you, it will only use the sanctions@dfat.gov.au email address.

The warning signs

The Sanctions Office advisory lists the red flags. The main ones:

• They won’t appear on camera or in person. On video, their location or appearance doesn’t add up, or they seem to use a filter such as a face-swap app.
• Interview answers, emails and chats read as if AI wrote them.
• They insist on written messages and use internet-based (VoIP) phone numbers only.
• Their name, location, education and work history differ between their freelance profile, social media, portfolio site and payment account.
• They bid on lots of jobs and charge below market rates.
• They change phone numbers, addresses or bank details often.
• They ask to be paid by PayPal, remittance services, cryptocurrency or offshore accounts.
• Their account logs in from several countries in a short time, or stays logged in for more than 24 hours.
• They connect through remote-access software rather than the laptop you sent them.

One flag isn’t proof. Several together are a reason to stop and check.

Don’t rely on your recruiter

Recruitment agencies have themselves been targeted, so don’t rely on their checks alone. Do your own identity checks, even if an agency found the worker for you.

If you already pay remote contractors you’ve never met, limit what they can reach to what the job needs. For a wider security baseline, our guide to the Essential Eight for small businesses covers controlling who can access what.

Checklist

• Hold a video or face-to-face interview. Be wary of anyone who won’t appear on camera, or whose location or appearance doesn’t add up.
• Compare their profiles. Check that name, location, education and work history match across the freelance platform, LinkedIn, portfolio site and payment account.
• Verify past employers yourself. Contact listed employers and universities using details you find independently, not the ones on the CV.
• Run a reverse image search on their profile photo. Look for a photo copied from elsewhere or altered with AI.
• Pay through a bank in their name. Refuse cryptocurrency, PayPal and remittance services, and query any request to pay an account in a different name.
• Check ID documents yourself, even for agency hires. Scrutinise licences and passports for forgery rather than relying on the recruiter’s checks.
• Keep system access on the laptop you supply. Require remote workers to connect from that device, not through remote-access software, and to switch off commercial VPNs.
• Limit unverified contractors. Give remote workers you haven’t verified in person access only to the systems and data the job needs.