Australia sanctions North Korean IT-worker networks behind remote jobs

Australia sanctions North Korean IT-worker networks behind remote jobs

23 October 2026: Australia has imposed targeted financial sanctions and travel bans on two North Korean individuals and two companies that place North Korean IT workers in remote jobs abroad to earn foreign currency for the regime. For any business that hires remote developers or contractors, paying a listed person or company, directly or through an intermediary, without the minister's authorisation is a criminal offence.

Not yet independently verified. The penalty figures and the foreign minister's statement are as iTnews reports them; we could not reach the Department of Foreign Affairs and Trade pages again to confirm the wording when this was published. We will update this when it can be confirmed, and remove this note.

Who is on the list

The listings, made under regulation 6 of the Autonomous Sanctions Regulations 2011 and added to the Department of Foreign Affairs and Trade's Consolidated List on 23 October, cover:

• Yu Pu Ung, described by iTnews as a China-based representative of North Korea's Tanchon Bank;
• Sim Hyon Sop, described as a deputy representative of Korea Kwangson Banking Corp in Dandong;
• Korea Mangyongdae Computer Technology Company, which runs IT worker delegations out of Shenyang and Dandong;
• Chinyong Information Technology Cooperation Company, which manages teams of IT workers in Russia and Laos.

All four were already under United States sanctions. Foreign Minister Penny Wong said the action was taken in coordination with international partners, including the European Union, and it follows findings of the Multilateral Sanctions Monitoring Team.

How the workers get hired

The Australian Sanctions Office's advisory on North Korean IT workers says Australia's competitive salaries and demand for contract IT staff make it an attractive target. Workers pose as nationals of other countries and use stolen or doctored Australian driver's licences and passports. Local companies have been approached through LinkedIn, Fiverr and Freelancer and through recruitment firms, and the office has told businesses not to rely on a recruiter's checks. The warning signs it lists include interview answers that read as generated by AI, face-swap filters on video calls, logins from several countries in quick succession, and bids well below market rates.

What it costs to get it wrong

Using or dealing with a listed party's assets, or making assets available to them, without authorisation is an offence. iTnews reports penalties of up to 10 years in prison and fines of up to $910,000 for individuals, or three times the value of the transactions if greater, and up to $3.64 million for companies, with a defence for a business that can show it took reasonable precautions and exercised due diligence. That defence is the practical point for buyers: identity verification done by the hiring company itself, a check of payees against the Consolidated List, and records of both. Permits are requested through the office's online portal, Pax.

Sources

• Department of Foreign Affairs and Trade: two persons and two entities listed under the Autonomous Sanctions Regulations 2011 (DPRK), 23 October 2026
• Australian Sanctions Office: advisory on DPRK information technology workers (updated 31 July 2026), 31 July 2026
• iTnews: Australia sanctions North Korean IT worker bosses and financiers, 23 October 2026