TL;DR
- 01What happened
On September 18, 2026, Japan’s National Police Agency and National Cybersecurity Office, together with US, Australian and German authorities, published the activities of North Korean IT workers. The workers took ID images from enablers living in Japan and, posing as those enablers, won work through crowdsourcing services. Remote-controlled PCs placed in an enabler’s home (a laptop farm) were identified and dismantled for the first time in Japan, and hundreds of millions of yen had been sent abroad in crypto and other forms.
- 02Why it was hard to tell
The ID was genuine and the connection came from the enabler’s home in Japan. From the client’s side, both the document check and the connection check pass correctly.
- 03The missing layer
A crypto exchange spotted red flags and declined to hire, and police tracked down the farm. What failed was the layer that confirms, before work is handed over, that the ID holder and the person doing the work are the same.
What happened
- Disclosure
- On September 18, 2026, the National Police Agency and National Cybersecurity Office published a joint advisory with the US FBI and DoD Cyber Crime Center (DC3), Australia’s ASD’s ACSC, and Germany’s BND and BfV: seven agencies in all.
- Method
- Using ID images supplied by enablers, the workers posed as the enablers and won work. In other cases they took on work the enablers had won, or had pay sent to the enabler’s bank account and forwarded on.
- Hiding their location
- Remote-controlled PCs in enablers’ homes (laptop farms), or VPSs rented by enablers, made the work appear to come from inside Japan.
- Money sent
- Hundreds of millions of yen sent abroad in crypto and other forms, including amounts found in related investigations.
- Harm to clients
- In one case, after a payment dispute, a worker published the source code they had worked on; in another, a website a worker helped build was later defaced.
- Related attacks
- The same advisory covers “WaterPlum”, a group that poses as recruiters to get IT professionals to run malware; an estimated 30,000+ devices in over 100 countries and regions were infected. The NPA and FBI assess that WaterPlum and some North Korean IT workers operate under the same command.
Glossary
Laptop farm — PCs placed in an enabler's home and remote-controlled from abroad, so the work appears to be done from inside the country.
Enabler — A local person who supplies ID images, a bank account or a home connection to help North Korean IT workers win work.
Crowdsourcing — Online services for giving work to freelancers. Clients often meet the worker only through a screen.
The point to stop it is ③: before handing over work and access, confirm the person doing it is the same as the ID holder.
Lends a bank account too.
Applies through crowdsourcing.
The document is genuine and the connection is local.
Hundreds of millions of yen sent abroad.
Timeline — disclosure and response
- Someone applies for an engineering job at crypto exchange bitFlyer with a résumé in another person’s name. The firm, aware it might be a North Korean IT worker, interviews them, spots red flags and declines to hire (no harm).
- The NPA, Ministry of Foreign Affairs and others publish an alert about North Korean IT workers.
- The seven agencies publish the joint advisory, including the dismantling of Japan’s first laptop farm.
The primary source is the joint advisory by seven agencies in Japan, the US, Australia and Germany. The laptop farm’s location, when it was dismantled, the number of enablers involved and the names of Japanese clients have not been disclosed. “Hundreds of millions of yen” is the advisory’s own wording.
After disclosure
- For organisations that outsource: Consider that North Korean IT workers may be involved, including through subcontractors, and make bans on outsourcing and subcontracting explicit in contracts. Keep information and access given to contractors to a minimum, and revoke accounts and sessions as soon as there is suspicion.
- Hiring checks: The advisory lists matching the access IP address with the stated location, checking contact details, asking for concrete explanations of skills, and checking certification numbers.
- Legal warning: Giving work to and paying North Korean IT workers, or helping them earn foreign currency, may violate Japanese law and sanctions on North Korea. Separately, paying someone known to be North Korean, or giving them ID documents (including images), may amount to taking part in a crime.
Why it wasn’t stopped
This case was not a failure to spot forged IDs, nor of careless interviewers. The ID was genuine, and nothing tied its holder to the person actually working on the other side of the screen before the work was handed over.
The ID submitted was genuine, but nothing tied its holder to the person actually working on the other side of the screen before the work was handed over.
Proof works before work and access are handed over; detection works after red flags surface. In between, the worker is treated as the ID holder.
Pay went to the enabler's account
Detection worked: bitFlyer declined to hire after mismatches between the résumé and the answers, and police tracked down the farm. But most checks in the advisory look for red flags, and WaterPlum members advised each other to use face-swapping software in interviews for only a few minutes, then turn the video off, blaming the connection. “The ID is genuine” and “the person working is its holder” are separate facts, and once red flags are erased, the first alone gets through. That distance is the detection–proof gap, and it is a structural one.
The same structure appears in eKYC liveness bypass (swapped video passing an identity check).
How to counter this
Confirm the person doing the work, not an ID image, before handing over work and access. An image can be copied and handed over, so it cannot tie the holder to the worker. Confirm it is the same person not only at contract time but every time they enter your systems, and align the payee with the person you confirmed.
Industries and operations to watch
- IndustryDevelopers & agent operations
- Organisations that outsource software development or web production through crowdsourcing or contracts. They often hand over source code and credentials.
- OperationAccounts & permissions
- Giving outside workers accounts for repositories and internal systems. Once given, their actions are treated as legitimate.
Do today’s controls close it?
| Control | This case | Why |
|---|---|---|
| Checking ID images | Ineffective | The IDs belonged to real residents of Japan and were genuine. |
| Checking the connection (IP address) | Ineffective | Connections came from enablers’ homes or servers they rented. |
| Judgement in interviews | Partial | Odd answers gave one case away, but red flags can be erased. |
| Minimising information and access given | Partial | It limits harm, but who received it remains unknown. |
- Confirm with a method only the person can use, not an ID image. For workers in Japan, use something like the My Number Card’s public certificate, which only the person holding the card and PIN can pass. Unlike an image, it cannot be copied and handed over.
- Confirm it is the same person at every access. Check that the person entering repositories and internal systems is the one confirmed at contract time, every time. Revoke accounts and sessions at the first suspicion.
- Record who was given the work and who was paid. Align the payee with the confirmed person and keep it in a form that can later be shown to a third party: in other words, as proof. It also serves as the client’s explanation if questioned over a violation.
Three things to confirm in your organisation about giving work to outside workers
- Do you confirm, by something other than an image, that outside workers are the ID holders themselves?
- Do your contracts, including subcontracting, let you know who is actually doing the work?
- Can you stop accounts given to workers at once when suspicion arises?
Note: an ID holder colluding by handing over the card or device itself cannot be stopped by this check. Extra confirmation also makes short, small jobs harder to outsource.
Sources
- Primary, government disclosureNational Police Agency / National Cybersecurity Office Public attribution by Japan, the US, Australia and Germany regarding WaterPlum and North Korean IT workers
- Primary, joint advisory, JapaneseSeven agencies Joint advisory on WaterPlum and North Korean IT workers
- Primary, joint advisory, EnglishSeven agencies “North Korean ‘WaterPlum,’ commonly referred to as ‘Contagious Interview,’ Cyber Actor Group Targeting IT Professionals; Activities of North Korean IT Workers in Japan, the United States and Europe”
- Primary, earlier alertNational Police Agency and others Alert to companies about North Korean IT workers
1 more (reporting, analysis)
- ReportingThe Register “North Korea’s fake job interviews infected 30,000 devices”
References: “The last layer left for cyber defense in the age of AI”