How Lax Enforcement in Laos Undermines Security on the Korean Peninsula
U.S. and South Korean authorities cannot take down every North Korean cyber unit working overseas, but should prioritize third countries in Southeast Asia.
North Korean IT workers employed remotely by Western companies generate considerable revenue for the Kim family regime. According to recent estimates, the North Korean IT worker scheme brings in around USD 250 to 600 million annually. South Korean police are also investigating whether a North Korean IT worker used a false identity and secretly worked for a South Korean company.
To combat this illicit activity, U.S. and South Korean authorities should target the locales from which these North Korean operatives work abroad. While many North Koreans work from China or Russia, some use Laos as their hub of cyber operations—and Vientiane is far easier to pressure than Beijing or Moscow.
Although many of these remote workers take jobs at U.S.-based companies, they routinely work overseas and use the readily available internet in China, Russia, and Southeast Asia. In March 2026, the U.S. Department of the Treasury sanctioned Yun Song Guk, the leader of a North Korean IT worker unit based in Boten, Laos. Yun worked with a Vietnamese national, Hoang Minh Quang, to launder the IT workers’ salaries through local bank accounts for eventual transfer back to Pyongyang. This follows sanctions from January 2025, which listed two North Korean front companies working out of Laos that housed North Korean IT workers. Moreover, it appears that North Korean hackers are sharing money laundering networks with local fraudsters and drug traffickers in Southeast Asia. Thus, North Korean cyber operations in the Mekong region also impact the security and stability of these host governments.
Considering South Korea’s December 2025 upgrade of its diplomatic relationship with Laos to a “comprehensive partnership,” Seoul should formally ask Vientiane to crack down on North Korean cyber activities in the country. For too long, the communist government in Laos has sought to leverage its cordial ties with both North and South Korea for maximum national gain. However, Laos has much more to lose economically if South Korea backs away from this recently elevated relationship. Washington and Seoul should jointly press Vientiane to take the North Korean cyber threat more seriously.
Gaining Chinese or Russian cooperation on North Korean cyber issues is increasingly difficult and fraught with diplomatic challenges. However, North Korean cyber operatives have routinely used Laos as a hub for their illicit activities. For example, in May 2023, the Treasury sanctioned a North Korean military front company, the Chinyong Information Technology Cooperation Company, which managed North Korean IT worker delegations in Laos and Russia. Given the relative weakness of Laos, both Washington and Seoul should lean on their economic advantage to pressure Vientiane on this issue.
Currently, North Korean citizens can visit Laos after applying for an e-Visa or a visa on arrival. Laos should make this visa application process much more rigorous for North Korean nationals. Considering Pyongyang’s strict control of its citizens’ travel abroad, Laotian authorities should treat every North Korean national traveling to their country as a likely government agent or subversive. While Laos is small potatoes compared to North Korea’s more expansive cyber presence in China and Russia, it is likely a softer target for U.S. and South Korean diplomatic pressure.
North Korea’s presence in Southeast Asia should not be dismissed as passive or peaceful. The Kim family regime has a long history of conducting deadly operations in Southeast Asia. For instance, in 1983, North Korean agents attempted to assassinate South Korean President Chun Doo-hwan in Burma, killing twenty-one people. In 2017, North Korean agents hatched a successful plot to kill North Korean leader Kim Jong Un’s half-brother, Kim Jong Nam, at the Kuala Lumpur International Airport.
While U.S. and South Korean authorities cannot take down every North Korean cyber unit working overseas, they should prioritize third countries in Southeast Asia, chiefly Laos, from which these North Korean IT workers illegally generate revenue for the regime.
Benjamin R. Young is Nonresident Fellow at the Korea Economic Institute of America (KEI) and Assistant Professor of Intelligence Studies at Fayetteville State University. The views expressed here are the author’s alone.
This material is distributed by KEI on behalf of the Korea Institute for International Economic Policy. Additional information is available at the Department of Justice, Washington, DC.