A North Korean operative used fake identity documents to land remote IT contract work with a large New Zealand business, then threatened to leak commercially sensitive information when the company found out and refused to pay, according to the Cyber Threat Report 2026 released by the National Cyber Security Centre (NCSC) on Thursday 24 September.
The case is the first time the NCSC has publicly described North Korea’s remote IT worker scheme reaching inside a New Zealand company. The business has not been named.
According to the report, the company became suspicious of the identity details of an IT contractor who was working remotely. It contacted the NCSC and New Zealand Police, and the investigation identified the worker as being from North Korea.
The worker had built a false persona to get the job, using fake identity documents and a New Zealand address as a contact point. They had also recruited a New Zealand citizen to receive the company’s laptop and operate it on their behalf, which would have made the work appear to be coming from inside the country.
The report says the business immediately ended the worker’s employment and refused to pay for their services. The worker then claimed to have obtained commercially sensitive information and threatened to release it unless they were paid.
NCSC head Catriona Robinson said it was a new type of threat for New Zealand firms. “We are also seeing new types of threat emerge, including that of a North Korean IT worker clandestinely obtaining remote IT work with a New Zealand business in order to earn foreign currency for the North Korean state,” she said in the NCSC’s release. “This kind of activity is subject to UN Sanctions which have effect under New Zealand law and also creates risks of espionage and extortion for businesses that are targeted.”
The report describes a coordinated programme run by the North Korean state that places remote IT workers in overseas companies to earn money for the regime, including for its sanctioned weapons programmes. The workers often operate through front companies overseen by the North Korean state and use identity masking technology to hide where they are. In some cases they also carry out malicious cyber operations.
The money involved is large. 1News reported that United States authorities estimated the scheme generated about US$800 million in 2024.
For New Zealand employers the legal exposure is real as well as the security risk. United Nations sanctions against North Korea have effect in New Zealand law, and the report notes they prohibit granting work visas to North Korean nationals and exporting data or software to North Korea or for its benefit. A business that unknowingly pays such a worker could find itself caught up in a sanctions matter as well as a data breach.
The NCSC’s advice is practical and aimed squarely at hiring managers. It suggests organisations interview potential staff face to face and require new staff to pick up their IT equipment in person. It also lists warning signs to watch for, including requests to be paid in cryptocurrency, refusal to join video calls and unusual working hours.
Those steps cut against the way many firms have hired since the pandemic, when fully remote contractors became normal in software development, IT support and data work. Small and medium businesses that lean on overseas freelancers and contracting platforms may find face-to-face checks the hardest to put in place.
The North Korean case sits within a wider picture of a busier and more serious year for cyber attacks on New Zealand organisations. The NCSC received 4673 incident reports in the year to 30 June 2026, down from 5995 the year before. But the number of incidents it treated as being of potential national significance rose to 369 from 331.
Of those 369 incidents, 162 were linked to criminal or financially motivated actors, an 18 percent rise on the previous year’s 137. Another 86, or 23 percent, had suspected links to state-sponsored actors, up from 82. The report names China, Russia, Iran and North Korea as the states behind that activity, and describes China as the most persistent and capable state actor carrying out cyber activity in New Zealand.
Four incidents were classified as C2, or highly significant. “That’s as many in one year as were recorded over the previous ten years,” Robinson said. The report points to the theft of more than 99,000 patient records from the Manage My Health patient portal and the breach of the Canvas learning system used by some of the country’s largest educational institutions as high-profile examples.
Direct financial losses reported to the NCSC totalled $23.8 million in 2025/26, down from $26.9 million a year earlier. The agency warns that figure only captures losses that victims choose to volunteer, and the true cost is likely to be much higher.
Much of the report is about artificial intelligence. The NCSC’s leading judgement is that frontier AI is rapidly reshaping cyber threats, and it believes that by early 2027 malicious actors may have access to advanced AI capabilities currently available only through leading frontier models. “AI offers many opportunities, but it is already being used by malicious actors to increase the speed, scale and sophistication of cyber attacks,” Robinson said.
She put the responsibility for preparing on company boards and senior managers rather than government. “Government cannot protect every organisation from every cyber threat. Leaders are responsible for cyber security within their organisations, and those who prepare now will be best placed to manage the challenges of frontier AI,” she said.
The NCSC says most common cybercrime could still be prevented with basic measures such as multi-factor authentication, long strong passwords and passkeys. Businesses and individuals can report incidents through the NCSC website.
Has your business changed how it hires or checks remote contractors, and would face-to-face interviews work for you? Tell us in the comments below.
This article was written by AI, briefed to report the facts, hopefully without some of the bias people bring to the job 🙂
Leave a Reply