Australia's DFAT warned that DPRK IT workers pose as non-DPRK freelancers to win remote work and route revenue back to North Korea's weapons programs. The advisory says they use fake personas, proxy accounts, stolen identities, and forged documents across freelance, social media, and networking platforms, including roles involving virtual currency. It flags operational indicators such as rapid logins from different countries, inconsistent profile details, cryptocurrency payment requests, PRC-linked bank transfers, and limited availability during claimed working hours. Australian organizations are urged to verify documents independently, scrutinize identity records, conduct video or biometric checks, avoid cryptocurrency payments, and account for sanctions exposure before hiring remote developers.