Security1 publisher2 min readPublished
Argentina and Pakistan open cases against the local handlers in North Korea's IT worker scheme
The MSMT says Vietnam, Laos, Pakistan and Argentina had all acted on last October's UN findings by July. The named targets are an alleged money launderer in Argentina and an alleged document forger in Pakistan.
The Watch · Security desk
What happened
- The MSMT, the U.S.-led committee that tracks compliance with UN sanctions on North Korea, published a report Wednesday on the thousands of North Korean nationals working outside the country.
- It says that as of July, Vietnam, Laos, Pakistan and Argentina had all taken meaningful steps in response to the allegations in last October's UN study of the IT worker scheme.
- Argentina opened an investigation into Antonia Doroganova, accused of laundering North Korean IT worker earnings through payment accounts, and froze some assets tied to her.
- Pakistan's Federal Investigation Agency opened a case against alleged document forger Syeda Aliya Batool Zaidi and is investigating Syed Sohail Mehdi and Syed Kazim over the same scheme.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure The money these cases follow starts in a hiring company's payroll, and the enforcement is landing on the launderers and forgers downstream of it, so a defrauded employer learns about its own hire from a sanctions listing or an investigator.
- capability The Sinuiju building lets Pyongyang keep billing foreign clients over Chinese internet without putting a worker across the border, so tighter Chinese entry controls cut the headcount in China without cutting the revenue.
- contradiction Laos denies that several of the companies on the MSMT's list exist at all, which leaves the compliance record in each host state dependent on the state under review.
- precedent Prosecuting the local fixer is now the demonstrated template, and the UN placed North Korean IT teams in China plus about 40 other countries that have yet to produce a case.
Three of the four responses reach the same layer of the operation: the local people and firms that turn the work into spendable money. Vietnam and Laos are in the report because the U.S. sanctioned companies and officials there in March, entities UN investigators had already identified as helping North Koreans open local bank accounts and launder their earnings [8].
Every target named is a facilitator. The scheme's entry point is somewhere else: the workers steal or purchase identities to get hired into high-paying IT roles, usually at companies [2]. The Record's account of Wednesday's report does not describe any action against a business that hired one [21]. For an employer, the control that exists is the identity check before the offer.
Nine months separate the October study from the July status count [19]. U.S. officials had already described Argentina's actions and a Pakistani detention in January [7]. Laos' own answer shows the pace underneath: it told the MSMT that 19 of the North Koreans named in October entered the country between 2018 and 2019 and all had left by 2025 [9]. UN resolutions required every North Korean national to be repatriated by 2019 [11]. Those departures ran as much as six years past that deadline [20].
The pressure in China is coming from counterintelligence. The MSMT said the workers there face "stricter and increased surveillance by Chinese authorities", alongside several reports of arrests for alleged espionage [13]. "In particular, in April 2025, a North Korean IT worker dispatched to China was reportedly arrested and detained by Chinese public security authorities for allegedly stealing Chinese military secrets," MSMT investigators said [14]. "Moreover, stricter and increased surveillance has restricted DPRK's ability to deploy new batches of IT workers. As of July 2025, North Korean IT workers have had trouble entering China," the report said [15].
The response has been disguise. An MSMT member reported that one North Korean IT company tried to obtain residency permits from China's Foreign Affairs Ministry by presenting its workers as employees of a trading company, and other firms tried to bring North Koreans in as garment laborers [17]. In Laos, surveillance pushed the workers out of Vientiane to the provincial city of Vang Vieng, and the government told the MSMT it has created a national committee to investigate the scheme and implement UN rules [18].
North Koreans working outside the country generated up to $800 million last year, much of it from the IT worker scheme [12].
What to watch
- Whether any of the four countries' cases reaches a charge against a company that hired one of the workers rather than a facilitator.
- Whether the next MSMT report shows the Sinuiju arrangement expanding as Chinese entry restrictions hold.
- Whether Laos' new national committee produces findings that account for the companies its government says do not exist.