Google Warns of North Korea-Linked Fraudsters Targeting UK Crypto Firms

A new report from Google’s Threat Intelligence Group (GTIG), released on April 2, has exposed a growing network of North Korean-linked fraudulent IT workers who are adapting to increased scrutiny by U.S. authorities. 

These operatives, posing as legitimate remote workers, have infiltrated tech firms worldwide and even secured positions in sensitive blockchain and AI projects.

Google’s Threat Intelligence Group (GTIG) has uncovered an alarming expansion of North Korean cyberespionage operations into Europe, after initially targeting the U.S. These “cyber warriors” are state-backed IT operatives posing as freelance workers to infiltrate private… pic.twitter.com/Gxmj7Lt86A

— Clash Report (@clashreport) April 2, 2025

Fraudsters Expanding Operations Beyond the U.S.

According to GTIG adviser Jamie Collier, North Korean cyber operatives have established a sophisticated ecosystem of fake identities to evade detection and continue their activities.

“With increased awareness in the U.S., they’ve created a global ecosystem of fraudulent personas to enhance operational agility,”

Collier stated.

The report reveals that these operatives have been active in various tech sectors, ranging from conventional web development to advanced blockchain applications. 

Notably, they have contributed to smart contract development on Solana and Anchor, demonstrating their growing expertise in blockchain technology.

“Coupled with the discovery of facilitators in the UK, this suggests the rapid formation of a global infrastructure and support network that empowers their continued operations,”

Jamie added.

Heightened scrutiny from U.S. authorities has forced many of these fraudulent workers to seek employment outside the country. 

By masquerading as legitimate professionals, they have gained access to firms handling critical projects, potentially exposing these businesses to significant security risks.

Extortion Threats on the Rise

The GTIG report also highlights a disturbing rise in extortion attempts by dismissed North Korean IT workers. 

Since October, former employees who were likely caught engaging in fraudulent activity have been blackmailing their ex-employers, threatening to leak sensitive company data unless paid off.

“In these incidents, recently fired IT workers threatened to release their former employers’ sensitive data or to provide it to a competitor,”

the report noted.

The stolen data often includes proprietary code and valuable company intelligence, which competitors or other malicious actors could exploit. 

This wave of extortion coincides with recent law enforcement actions against North Korean cyber activities.

Just last month, the U.S. Department of Justice indicted two North Korean nationals and three accomplices for orchestrating a fraudulent remote IT employment scheme that reportedly spanned over 60 companies. 

The illicit earnings from these schemes have been funneled back to the North Korean regime, further raising concerns about national security and economic threats.

As the tactics of these cyber operatives continue to evolve, companies are urged to strengthen their hiring verification processes and enhance internal security measures. 

The GTIG report serves as a stark reminder of the persistent and growing threat posed by North Korean cyber activities in the global tech industry.