Spotlight: Uncovered Russia-based North Korean IT Worker Cell

MSMT/2026/1 "The DPRK Use of Overseas Labour to Violate and Evade UN Sanctions" (16 Sep 2026)

When data leaked from an account believed to belong to North Korean IT workers on a code sharing software development platform, a cyber security expert was able to garner further insight into the IT worker’s operations. The analysis revealed that the DPRK -owned account was accessed from an IP address in Russia. The IT workers are hierarchically organized under a clear chain of command and have been involved in foreign currency acquisition activities since at least Dec ember 2024. The data also identified more than five chat groups on Slack, a workplace messaging platform, associated with the account. Of these, fi ve were identified as active: four operational groups, each consisting of approximately ten workers, and one group comprising both workers and their supervisor.192 The leaked data included a list of contracted projects, forged passport data, and chat logs exchanged between North Korean IT workers. In one of the Slack chat groups, an individual believed to be the s upervisor sent a message stating, “You should work at least 14 hours or more”. Worktime tracking software was installed on the devices used by the IT workers, suggesting that minimum working hours were strictly enforced. In another Slack chat group, messages like “Do you have a passport?”, “I have a Canadian one“, and “I have a Japanese one ” were exchanged. IT workers cooperate with one another to find employment and bypass identity verification.