Beyond machine translation: struggles and adaptations of North Korean IT workers in Japan's crowdsourcing market

Beyond Machine Translation: Struggles and Adaptations of North Korean IT Workers in Japan's Crowdsourcing Market

Speakers: Yoshihiro Kori (Intelligence Analyst, NEC), Takahiro Kakumaru (NEC)

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=0SQ_T-uxHr8

Overview

This presentation, delivered by Yoshihiro Kori and Takahiro Kakumaru from NEC, delves into the often-overlooked activities of North Korean IT workers operating within the Japanese crowdsourcing market. While much of the existing research on North Korean cyber activities focuses on English-speaking environments, this talk sheds critical light on their adaptation to a non-English, locally-specific ecosystem. The speakers highlight how these illicit workers leverage machine translation, manipulate platform features, and even acquire legitimate accounts to secure jobs and generate revenue, ultimately contributing to North Korea's sanctioned nuclear and missile programs.

The talk is particularly significant because it uncovers the unique challenges and sophisticated tactics employed by North Korean IT workers when faced with a language barrier and distinct cultural norms. By analyzing their profiles, project submissions, and online interactions within Japanese platforms, the researchers expose identifiable patterns and linguistic tells that betray their true origins despite their attempts at impersonation. This research not only provides a crucial reference for tracking such activities in other non-English linguistic areas but also underscores the urgent need for crowdsourcing platforms and employers worldwide to enhance their vigilance and screening processes.

The findings presented are vital for the cybersecurity community, government agencies, and private businesses. They illustrate the persistent and adaptive nature of North Korea's illicit revenue generation efforts, demonstrating how seemingly innocuous online activities can serve as a conduit for funding dangerous state-sponsored programs. Understanding these tactics is essential for developing more effective countermeasures and protecting both individuals and national security interests from economic exploitation and cyber threats.

Background

▶ Watch: North Korean IT workers adapting to Japan's IT market (2:00)

The activities of North Korean IT workers have garnered significant international attention, particularly due to their role in generating foreign currency for the DPRK regime, often in defiance of international sanctions. These workers are known for impersonating individuals from various countries to secure remote IT jobs, with many reports concentrating on their operations in English-speaking markets. However, this focus has left a crucial gap in understanding their presence and methods in other linguistic and cultural contexts. The Japanese market presents a unique environment for such analysis, given its distinct language, cultural nuances, and the increasing caution from the Japanese government, which has even led to arrests of individuals aiding North Korean IT workers.

North Korean IT workers adapt to these local conditions by utilizing Japan-based services, often relying heavily on machine translation to bridge the language gap. This necessity creates observable artifacts and inconsistencies that researchers can exploit. The Japanese crowdsourcing market itself possesses characteristics that unwittingly aid these illicit operations. For instance, anonymous registration and project acceptance are common, and real photos are rarely used for profile pictures, with AI-generated images, anime, or free stock photos being preferred. These norms inadvertently provide cover for individuals seeking to conceal their true identities. Furthermore, the prevalence of worker ranking systems on Japanese platforms, which employers use to find qualified candidates, becomes a target for manipulation, allowing North Korean IT workers to artificially boost their visibility and perceived credibility.

Prior work has established the broad scope of North Korean IT worker operations, but this research specifically highlights the granular details of their infiltration into a non-English speaking market. It addresses the critical need to investigate activities beyond the Anglosphere, recognizing that their adaptive strategies necessitate tracking across diverse local language services. The problem exists because current screening methods on many crowdsourcing platforms are insufficient to detect sophisticated impersonation and linguistic anomalies, especially when the platforms themselves are designed with cultural practices that facilitate anonymity.

Key Findings

▶ Watch: Detecting machine translation errors: the 'seu' mystery (10:00)

The research uncovered several critical findings regarding North Korean IT workers' operations in the Japanese crowdsourcing market, highlighting their adaptive strategies and exploitable weaknesses:

1. Ranking Manipulation: North Korean IT workers actively manipulate platform ranking systems, particularly the "thank you" ranking, which functions similarly to a "like" system. They press the "thank you" button for each other's accounts, artificially inflating their visibility and perceived success. This manipulation often results in a significant disparity (e.g., 10 times) between the number of "thank yous" and actual job orders received. The logs of these "thank you" clicks serve as a valuable investigative lead to discover additional linked accounts.

1. Machine Translation Artifacts: Despite their efforts, North Korean IT workers struggle with genuine Japanese language proficiency. Their reliance on machine translation, often a multi-stage process from Hangeul to English and then to Japanese, leaves identifiable linguistic traces. These include:

• Unnatural Phrasing: Profiles often contain phrases that native Japanese speakers would never use, indicating a templated approach translated through multiple languages.
• Incorrect Name Order: In English-speaking contexts, they might list their given name before their family name, but when translating to Japanese, they sometimes fail to revert to the standard Japanese order (family name then given name), betraying their non-native understanding.
• Non-existent Japanese Words: A striking example is the term "seu" listed as a hobby. This was found to be a machine translation error where the Korean term for "soft tennis" was incorrectly rendered into a non-existent Japanese word, demonstrating a fundamental lack of understanding of Japanese Kanji and linguistic nuance.

1. Profile Plagiarism and Collage: To create seemingly legitimate profiles and portfolios, these workers engage in extensive plagiarism. This includes copying text, images, and even lighting styles from existing technical blogs and GitHub repositories without modification. Profile pictures are often collages, identified by inconsistent pixel counts between the face and the background, with faces frequently taken from low-quality stock image thumbnails to avoid copyright detection.

1. Account Acquisition and Transformation: In a highly sophisticated tactic, North Korean IT workers acquire and take over legitimate accounts belonging to real Japanese individuals. In one notable case, an account initially operated by a Japanese person, "Koh Misuno," was transformed. The GitHub activity history and blog content of the acquired account did not align, and a change in the GitHub username from a Chinese name ("Chang") to the Japanese name "Koh Misuno" was observed. This allowed the North Korean operators to inherit the authenticity and established reputation of a real individual, making detection significantly harder.

1. Adaptation to Local Services: Beyond general crowdsourcing platforms, North Korean IT workers actively integrate into Japanese local business social networking services like Wantedly. They create profiles, claim senior roles (e.g., CTO at a Japanese startup), and promote achievements on these platforms to secure further work, showcasing a deep effort to embed themselves within the local ecosystem.

These findings collectively paint a picture of highly adaptive but ultimately detectable adversaries. While they continually refine their methods, their fundamental reliance on machine translation and their systematic approach to profile creation and account management leave distinct, traceable patterns for diligent investigators.

Technical Deep Dive

▶ Watch: Case study: Akiraama's extensive plagiarism and fake profiles (13:20)

The technical deep dive into North Korean IT worker activities in Japan reveals a systematic approach to exploiting platform mechanics, linguistic vulnerabilities, and social engineering. Their methods, while often sophisticated in execution, are underpinned by detectable patterns.

Central to their operational strategy is the manipulation of crowdsourcing platform ranking systems. Japanese platforms frequently feature various worker rankings (e.g., number of contracts, "thank you" counts) that employers use as a guide. North Korean IT workers target the "thank you" ranking, which functions similarly to a "like" button. Critically, anyone with an account can press this button. The speakers revealed that North Korean IT workers create multiple accounts and then mutually "thank" each other, artificially inflating their ranking. This leads to a significant discrepancy between the "thank you" count and the actual number of job orders received—sometimes a 10-fold difference. The logs of these "thank you" button clicks are a forensic goldmine, as they link multiple North Korean IT worker accounts, providing a traceable network for investigators.

The Japanese language skills of these workers are a significant vulnerability. Lacking native proficiency, they are entirely reliant on machine translation. This multi-stage translation process, typically from Hangeul (Korean) to English and then to Japanese, introduces characteristic errors. For instance, profiles created from templates are translated, but the resulting Japanese often contains phrases unnatural to native speakers. A specific example highlighted was the order of family and given names. While Japanese places the family name first (e.g., Kori Yoshihiro), and North Korean naming conventions are similar, the machine-translated profiles often retain the Western order (given name first) if the intermediate translation was English. This seemingly minor detail is a strong indicator of non-native origin.

A more striking linguistic anomaly was the discovery of the term "seu" listed under hobbies. After extensive investigation, it was revealed that "seu" was a direct, mistranslated rendition of the Korean term for "soft tennis." The machine translation process, likely unaware of the specific Japanese Kanji for sports (e.g., 野球 yakyu for baseball, 庭球 teikyu for tennis), produced a phonetic equivalent that does not exist in the Japanese language. This error, stemming from a lack of understanding of Japanese Kanji characters and their common pairings, serves as a powerful tell. The speakers demonstrated how a simple Google search for such unique, non-existent phrases could uncover multiple similar accounts across different Japanese crowdsourcing services.

Beyond linguistic errors, their technical profiles demonstrate widespread plagiarism and visual manipulation. When creating portfolios, technical blogs, and GitHub repositories, North Korean IT workers routinely copy and paste content—including text, images, and even specific lighting styles—from legitimate sources. This "low-quality work" is evidenced by their failure to change contact information or other identifying details within the plagiarized content. Profile pictures are often collages, where a face from a stock image (often a low-quality thumbnail to avoid direct copyright detection) is pasted onto a different body or background. Inconsistencies in pixel count between the face and the rest of the image readily expose this tactic.

Their operational sophistication extends to leveraging legitimate platforms like Wantedly, a Japanese business social networking service. They create profiles, claiming roles such as CTO at a Japanese startup company, and use these platforms to promote their (often plagiarized) achievements, thus building a seemingly credible online persona to attract further work. This indicates a deep understanding of local job-seeking mechanisms and a commitment to integrating into the professional landscape.

Finally, the most advanced tactic uncovered was the acquisition and transformation of existing accounts. In the case of "Koh Misuno," a legitimate Japanese individual's account was compromised or purchased. Analysis of the GitHub activity history revealed a dramatic shift in content and activity that did not align with the blog history maintained by the original owner. Crucially, the GitHub account name was changed from a Chinese name ("Chang") to "Koh Misuno" around October 2024 (as per the slide, though the presentation audio says September 2024), coinciding with a cessation of activity on X (formerly Twitter) and a change in project focus from video production to web development. This transformation allowed the North Korean IT worker to inherit a verified, high-quality profile, including certifications like "block cloud worker" and "top-tier engineer" on crowdsourcing services, significantly boosting their credibility and ability to secure high-value contracts. This method effectively bypasses initial screening processes by leveraging pre-established authenticity.

Demo / Proof of Concept

▶ Watch: Case study: Real Japanese account taken over by NK IT worker (18:00)

While the presentation did not feature a live, interactive demonstration in the traditional sense, it effectively presented two detailed case studies that served as compelling proofs of concept for the researchers' findings. These case studies illustrated the real-world application of their investigative techniques and concretely demonstrated the presence and methods of North Korean IT workers in the Japanese crowdsourcing market.

The first case study focused on an account named "Akiraama." This account was notable for consistently exhibiting the characteristics previously identified as indicative of North Korean IT worker activity: heavy reliance on templates and machine translation. Akiraama maintained a comprehensive online presence, including a portfolio site and a GitHub account, making it an ideal subject for in-depth investigation.

Upon examining Akiraama's portfolio, several key findings emerged. The portfolio included statements like "I am a full stack engineer" in English, reinforcing the observation that North Korean IT workers frequently favor terms like "full stack," "web three," and "blockchain." The profile picture was a clear collage, with inconsistent pixel counts between the face and the background, suggesting a face pasted from a low-quality stock image thumbnail. Surprisingly, the profile listed a detailed residential address, down to the story number, which was later discovered to be a property for rent, indicating no actual residence and a lack of concern for address consistency.

Further investigation into Akiraama's technical blogs and GitHub repository revealed extensive plagiarism. Every post, image, and even the "lighting style" was copied and pasted from original articles, which were easily discoverable through reverse image search and text analysis. The GitHub repository was similarly "low quality work," with copied content that often retained original contact information, further betraying its inauthenticity. The case study also showed Akiraama's presence on Wantedly, a Japanese business social networking service, where they claimed to be a CTO at a Japanese startup and promoted their work on two products. This demonstrated the workers' effort and adaptability in leveraging local social networking services to enhance their perceived legitimacy and secure further opportunities.

The second case study involved an account named "Koh Misuno," which was initially discovered through the ranking manipulation analysis. This account exhibited the signature characteristics of North Korean IT workers: machine translation, template use, and a significant disparity between "thank yous" and actual orders. Crucially, Koh Misuno had achieved "block cloud worker" and "top-tier engineer" certifications on the crowdsourcing service, presenting as a highly successful professional freelance engineer.

Koh Misuno also maintained a GitHub account, a blog, and an X (Twitter) account. Initially, these accounts appeared to belong to a genuine Japanese individual. However, a deeper dive revealed inconsistencies. The GitHub activity history did not align with the career history described on the blog. While the blog and X content were in perfectly normal Japanese, the GitHub activity showed no clear evidence of being created or initially operated by a Japanese person. The critical discovery was that the GitHub account had been active since 2016, but in October 2024 (or September 2024 per audio), it underwent a significant transformation: the username was changed from a Chinese name ("Chang") to the Japanese name "Koh Misuno." Concurrently, the X account stopped posting, and the worker's project focus shifted from video production to web development. The researchers concluded that the account operator had changed from a real Japanese person to a North Korean IT worker, likely through purchase or theft, allowing the North Korean operative to inherit the established authenticity and reputation of the legitimate individual. This case powerfully illustrated the sophisticated tactic of account acquisition for guaranteed authenticity.

These case studies, by providing concrete examples and detailed investigative steps, served as robust proofs of concept for the methods and findings discussed in the presentation, making the abstract concepts tangible and actionable for other researchers and defenders.

Defensive Implications

▶ Watch: Conclusion: Platforms' passive stance enables ongoing NK IT worker operations (20:30)

The detailed findings on North Korean IT workers' activities in Japan's crowdsourcing market carry significant defensive implications for individuals, employers, and platform providers globally. Understanding these tactics is crucial for mitigating the risks associated with unknowingly funding illicit state-sponsored activities.

For crowdsourcing service providers, the primary responsibility lies in enhancing their screening and verification processes. This includes:

• Proactive Monitoring of Ranking Anomalies: Platforms must implement automated systems to detect unusual spikes in "thank you" or "like" counts that do not correlate with actual job orders or client feedback. Disparities exceeding a certain threshold (e.g., 10 times difference) should flag accounts for manual review.
• Enhanced Linguistic Analysis: Integrating advanced linguistic analysis tools can identify machine translation artifacts, unnatural phrasing, incorrect naming conventions, and non-existent words. This could involve comparing profile text against a corpus of native language usage patterns.
• Stricter Profile Verification: Moving beyond anonymous registration, platforms should require more robust identity verification, including real-time video verification or government-issued ID checks, especially for accounts seeking high-value contracts or achieving top-tier rankings.
• Monitoring Account Transformations: Platforms should track significant changes in account names, project focus, and activity patterns, particularly when combined with inconsistencies in historical data (e.g., GitHub history vs. blog history).
• Collaboration with Security Researchers: Establishing formal channels for security researchers and intelligence analysts to report suspicious activity and share threat intelligence is vital. The passive stance of some service providers, as highlighted in the talk, allows these operations to continue unimpeded.

For employers and hiring managers, vigilance and critical assessment are paramount:

• Scrutinize Language and Phrasing: Pay close attention to the language used in profiles, proposals, and communications. Unnatural phrasing, grammatical errors atypical for a native speaker, or unusual word choices should raise red flags.
• Verify Portfolio and Background: Do not take portfolios, GitHub repositories, or social media profiles at face value. Conduct reverse image searches on profile pictures, check for plagiarism in technical articles, and cross-reference activity histories across different platforms to ensure consistency.
• Check for Address Consistency: If an address is provided, verify its legitimacy. As shown with Akiraama, a listed rental property is a strong indicator of impersonation.
• Beware of "Too Good to Be True" Profiles: Accounts with exceptionally high rankings or certifications but little verifiable client feedback or a suspicious history should be treated with caution.
• Conduct Video Interviews: Whenever possible, conduct video interviews to assess communication skills and verify identity, though this can be bypassed by sophisticated actors.

For security researchers and intelligence analysts, the findings provide a roadmap for future investigations:

• Expand Beyond English: This research underscores the necessity of investigating non-English language services and applying similar analytical techniques to other linguistic areas. The specific linguistic tells identified (e.g., "seu," name order) can be adapted for other language pairs.
• Leverage Ranking Logs: The "thank you" button logs are a powerful tool for discovering interconnected accounts and mapping out North Korean IT worker networks.
• Focus on Account Acquisition: The case of Koh Misuno highlights account acquisition as a significant threat. Researchers should develop methods to detect anomalous account changes and takeovers.
• Share Intelligence: Continuous sharing of indicators of compromise (IOCs) and observed tactics, techniques, and procedures (TTPs) across public and private sectors is essential to stay ahead of these adaptive adversaries.

Ultimately, a multi-layered defense strategy, combining technological solutions with human vigilance and international collaboration, is required to effectively counter the evolving threat posed by North Korean IT workers.

Key Takeaways

• North Korean IT workers are highly adaptive, actively infiltrating non-English crowdsourcing markets like Japan's to generate illicit revenue.
• Their reliance on multi-stage machine translation (Hangeul -> English -> Japanese) leaves identifiable linguistic artifacts, such as unnatural phrasing, incorrect name order, and non-existent words (e.g., "seu").
• They exploit platform features like "thank you" rankings through mutual manipulation to artificially boost their visibility and perceived credibility.
• Sophisticated tactics include extensive plagiarism of technical content and the acquisition and transformation of legitimate Japanese individuals' accounts to bypass verification and inherit authenticity.
• Crowdsourcing platforms and employers must enhance their screening processes with advanced linguistic analysis, anomaly detection for rankings, and more robust identity verification to counter these evolving threats.
• Investigation into North Korean IT worker activities must expand beyond English-speaking areas, applying similar forensic linguistic and behavioral analysis techniques to local language services worldwide.

About the Speaker(s)

Yoshihiro Kori is an Intelligence Analyst in the security division of NEC, a Japanese IT company. He is also a member of JC3, the Japan Cybercrime Control Center, a public and private partnership organization established with reference to the NCFDA in the United States. His work involves intelligence analysis, particularly focusing on cyber threats and illicit activities.

Takahiro Kakumaru is also affiliated with NEC, though his specific role and division were not detailed in the presentation transcript. He is credited as a co-speaker, contributing to the research and presentation on North Korean IT workers.