Pull to refresh
Logo
What Changed
Following Why Sign Up
Australia sanctions North Koreans behind fraudulent IT worker schemes

Australia sanctions North Koreans behind fraudulent IT worker schemes

Rule Changes

Asset freezes and travel bans hit two North Korean men and two firms linked to remote-work cash for Pyongyang's weapons programs

October 23rd, 2026: Australia sanctions two DPRK operatives, two companies

Overview

Updated Oct 27

Foreign Minister Penny Wong signed the listings on October 20, and they took effect October 23, 2026. Two North Korean men, Yu Pu Ung and Sim Hyon Sop, and two companies now face asset freezes, and the men face travel bans. Dealing with their assets without a government permit can bring up to 10 years in prison.

The scheme places North Korean workers in remote jobs abroad under false national identities, and the pay goes to the regime. That violates UN Security Council bans on North Korea exporting labour. On October 13, the US Justice Department announced charges, two arrests and the seizure of about 187 computer devices. Those actions were tied to more than 70 US employers.

Why it matters

Australian companies have been unwittingly hiring North Korean IT workers using stolen identities — funding weapons programs and creating criminal exposure.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

2
Individuals sanctioned
Yu Pu Ung and Sim Hyon Sop face asset freezes and travel bans.
2
Companies sanctioned
Korea Mangyondae Computer Technology and Chinyong Information Technology.
$910K
Maximum individual fine
Or three times the transaction value, whichever is greater.
$3.64M
Maximum company fine
Companies can defend by showing reasonable precautions and due diligence.
10 yrs
Maximum prison term
For making assets available to a listed person or entity without authorisation.

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

YU
Yu Pu Ung
China-based representative of Tanchon Bank, a North Korean bank under UN sanctions
Sanctioned by Australia and the US; subject to travel ban
SS
Sim Hyon Sop
Deputy representative of Korea Kwangson Banking Corp in Dandong, China
Sanctioned by Australia and the US; wanted by the FBI with a $5 million reward
 Penny Wong
Penny Wong
Australian Minister for Foreign Affairs
Authorized the October 2026 designations

Organizations Involved

KM
Korea Mangyondae Computer Technology Company
North Korean IT company
Sanctioned by Australia and the US

Runs IT worker delegations out of Shenyang and Dandong in China, according to US Treasury.
Chinyong Information Technology Cooperation Company
Chinyong Information Technology Cooperation Company
North Korean IT company
Sanctioned by Australia and the US

Manages teams of IT workers in Russia and Laos through a network of companies.
Australian Department of Foreign Affairs and Trade
Australian Department of Foreign Affairs and Trade
Government agency
Administered the sanctions

Administers the Autonomous Sanctions Regulations 2011 and maintains the Consolidated List of sanctioned entities.
AS
Australian Sanctions Office
Government body within DFAT
Issued advisory warning about DPRK IT worker fraud

Enforces Australian sanctions law and advises businesses on compliance.
Multilateral Sanctions Monitoring Team
Multilateral Sanctions Monitoring Team
International monitoring body
Findings informed Australia's sanctions

Reports on how North Korea evades UN Security Council sanctions.

Timeline

April 2023 October 2026

5 events Latest: October 23rd, 2026 · 3 weeks ago
Tap a bar to jump to that date

  1. Australia sanctions two DPRK operatives, two companies

    Latest Sanctions

    Australia freezes assets of two DPRK operatives and two IT firms over fake worker schemes.

  2. US Justice Department charges and seizes IT worker devices

    Enforcement

    The Justice Department announced an indictment, two arrests and searches of Texas laptop farms. Agents seized about 187 devices in a scheme that hit more than 70 US employers, with about $3 million in revenue according to DOJ.

  3. US designates Mangyondae IT company

    Sanctions

    US Treasury designates Korea Mangyondae Computer Technology Company over IT worker delegations.

  4. US Treasury names Yu Pu Ung a DPRK finance linchpin

    Sanctions

    US Treasury describes the China-based Yu as a linchpin of North Korea's illicit money-making.

  5. US sanctions reported against Sim Hyon Sop

    Sanctions

    Reporting links Sim to US sanctions. The exact designation date is not confirmed here.

Scenarios

1

EU follows with matching sanctions on DPRK IT networks

Likely Resolves by Q2 2027

Discussed by: Foreign Minister Penny Wong said Australia acted in coordination with the European Union.

Wong's statement said the action was taken "in coordination with international partners, including the European Union." An EU listing of the same four targets would extend asset freezes across European banks and hiring platforms, squeezing the networks' access to European employers.

2

North Korean networks resurface under new front companies

Likely Resolves by Oct 23, 2027

Discussed by: The ASO advisory describes the networks' adaptive tactics; US Treasury has sanctioned successive DPRK front companies over the past years.

North Korean IT operations have survived prior sanctions by forming new front companies and moving workers between host countries. If the MSMT or US Treasury designates successor companies or new individuals connected to the Yu or Sim networks within a year, the resurfacing scenario holds.

3

First Australian firm convicted over DPRK IT worker payments

Possible Resolves by Q2 2028

Discussed by: The ASO advisory's warnings to businesses suggest heightened enforcement; penalties run to 10 years' jail for individuals.

The ASO told companies not to rely on recruiters' due diligence, signaling enforcement focus. A prosecution would require evidence that a company made assets available to a listed entity without taking reasonable precautions. A conviction would be the first test of the new listings in an Australian court.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

2023

Arizona laptop farm case (2023)

US federal prosecutors and the FBI exposed a "laptop farm" in Arizona where North Korean IT workers used networked laptops and false identities to pose as Americans and access US companies' systems remotely. The Justice Department documented the operation in court filings.

Then

The operation was dismantled and charges pursued against organizers.

Now

It became a reference point for how North Korean IT workers use fabricated identities to bypass employment checks.

Why this matters now

The Arizona case demonstrated the same identity-fraud mechanism Australia is now sanctioning, and it predated the US and Australian designations of the same networks.

December 2017

UN Security Council Resolution 2397 (2017)

UN Security Council Resolution 2397 required member states to repatriate all North Korean overseas workers by December 2019, cutting off a legal source of foreign currency for Pyongyang.

Then

North Korea lost its legal overseas labour force within two years.

Now

Pyongyang shifted to covert IT worker schemes using stolen identities, which the MSMT says continue despite UN sanctions.

Why this matters now

The fraudulent IT worker networks Australia sanctioned are an evasion of the UN labour ban. Australia's listings cite UN Security Council resolutions including 1718 and subsequent ones.

Sources

(11)
+5
Australian Minister for Foreign Affairs Australian Department of Foreign Affairs and Trade iTnews South China Morning Post The Express Tribune Anadolu Agency Yonhap News Agency US Department of Justice ABC News EconoTimes Information Age (ACS)