North Korean IT contractor found working remotely in New Zealand

WELLINGTON: A North Korean IT worker used a fake identity to obtain remote work with a New Zealand company and then threatened to release sensitive information when exposed, Wellington's cybersecurity agency said Thursday.

New Zealand's National Cyber Security Centre said the IT contractor was working remotely for a large New Zealand business, which grew "suspicious" of his true identity over time.

"Investigation identified the worker as being from North Korea," the report said.

"The North Korean worker used a false persona including fake identity documents, a New Zealand address as a contact point and recruited a New Zealand citizen to receive and operate the company's laptop."

On learning the contractor's true identity, the business ended their employment and refused to pay for their services.

The worker then "claimed to have obtained commercially sensitive information and threatened to release this if not paid," the report added.

North Korea faces a slew of international sanctions over its weapons and nuclear programmes, which ban its citizens from being issued work visas abroad among a litany of other restrictions.

In July, the United States and 10 Asian and European allies warned companies against employing North Korean IT workers whose labour was generating crucial foreign currency to fund that nuclear weapons programme.

North Korea has furiously denied those allegations.

"In some cases, the workers also undertake malicious cyber operations. These workers often operate under front companies overseen by the North Korean state apparatus," New Zealand's Cyber Security Centre said.

The report urged businesses to interview potential contractors face-to-face to mitigate the risk of clandestine activities.

The 48-page risk assessment said 23 per cent of major cyber attacks on New Zealand last year were state-sponsored, naming China, Russia, Iran and North Korea as countries that had launched attacks.

It also warned of an increasing risk to the South Pacific, citing "state-sponsored cyber espionage targeting governments and infrastructure" in the region.