SKEENA REGION, B.C. – A high-level national security advisory is warning Canadian businesses of a sophisticated scheme involving North Korean IT workers posing as legitimate freelancers, a threat that has direct relevance for the small business community across the Skeena region.
The joint advisory, issued by the RCMP, Public Safety Canada, Global Affairs, and Canada’s financial and cyber security agencies, cautions that hiring these individuals—even unknowingly—could lead to severe legal consequences, major cybersecurity breaches, and the funding of North Korea’s illicit weapons programs.
With a thriving small business community and many companies supporting major industrial projects, the Skeena region presents potential targets for these schemes. The increasing reliance on remote work and online freelance platforms for services like web development, graphic design, and IT support puts local businesses at risk.
The Threat: Skilled Workers, Illicit Motives
According to the advisory, the North Korean state-affiliated workers are often highly skilled, competent, and offer their services at competitive rates, making them attractive to small businesses and start-ups that may lack extensive resources for screening job candidates.
“North Korean IT workers have also used their access to corporate systems for cyber espionage, money laundering, or to acquire sensitive materials for state-run enterprises,” the official warning stated.
To hide their identities and locations, these individuals are known to use VPNs, AI tools to generate fake resumes and emails, and even “deepfake” videos to mask their appearance during online interviews.
Red Flags for Local Employers
Authorities have provided a list of red flags that local business owners should watch for during the hiring process:
- Refusal or reluctance to participate in real-time video calls.
- Requests for payment in cryptocurrency.
- Inconsistencies in personal information, such as their resume, timezone, or educational background.
- Fees for their services that are significantly lower than market rates.
How to Protect Your Business
Cybersecurity expert Matt Immler, speaking to national media, emphasized that the best time to identify these individuals is during the hiring process. He offered simple tests to verify a candidate’s identity on a video call:
- Ask the candidate to perform a simple action that would disrupt a deepfake, such as putting their hand up in front of their face.
- Request that they temporarily drop their virtual background.
- Conduct an on-camera ID verification.
The advisory also urges all Canadian businesses to conduct thorough background and reference checks by directly contacting previous employers and educational institutions.
“The primary motivator behind this is the money,” Immler noted, explaining that the funds are funnelled back to the North Korean regime. “There are definitely espionage threats there, but this is about finding ways to subsidize whatever their government is doing.”
Any suspected sanctions violations should be reported directly to the RCMP at 1-800-420-5805, while suspicious financial transactions should be reported to FINTRAC.
