Beyond machine translation struggles and adaptations of North Korean IT workers in Japan's...

### Overview In this presentation, intelligence analyst Yoshihiro Korei from the security division of Japanese IT company N and member of JC3 (Japan Cybercrime Control Center) details how North Korean IT workers adapt their operations to the Japanese market. While previous industry investigations have predominantly focused on English-language activity, North Korean operatives actively target local language markets. In Japan, operatives exploit domestic crowdsourcing platforms and local business networks, relying on machine translation, template profiles, ranking manipulation, and account takeovers to secure contracts.

### Key Topics - **Japanese Crowdsourcing Ecosystem**: Cultural norms on Japanese freelance and crowdsourcing platforms—such as widespread anonymous registration, order acceptance without identity verification, and the common use of anime, stock, or AI-generated profile photos—make it easy for foreign operatives to blend in. - **Language Struggles & Machine Translation Detection**: Because operatives generally do not understand Japanese, they rely on multi-stage machine translation (e.g., Hangul to English to Japanese). This process introduces distinct anomalies, including unnatural Western name ordering (given name before family name), non-existent kanji coinages (such as "sekyu" for soft tennis derived from Hangul), and rigid template phrases that native speakers do not use. - **Ranking Manipulation**: Platforms display weekly and monthly worker rankings based on metrics like contract count and "Thank You" button clicks (similar to "likes"). North Korean workers systematically manipulate these leaderboards by creating networks of accounts that click "Thank You" for each other. This creates traceable discrepancies where accounts have roughly ten times more "Thank You" clicks than actual completed orders.

### Technical Details & Case Studies - **Case Study: Akira Akiyama**: This account maintained a portfolio and GitHub presence claiming "full stack engineer" status (noting that workers also favor terms like "web3" and "blockchain"). Investigation revealed the profile picture was a composite collage pasting a stock image face over a low-quality thumbnail to evade copyright detection. Listed residential addresses pointed to vacant rental units. Blog posts and GitHub repositories were entirely plagiarized down to unedited original contact details. Remarkably, this persona created an account on the Japanese business network Wantedly and secured a role as CTO at a Japanese startup, contributing to two products. - **Case Study: Kohei Mizuno**: An account certified as a "pro crowd worker" and top-tier freelance engineer. Although its associated blog and X (formerly Twitter) accounts originally featured natural Japanese and video production work, forensic inspection of the associated GitHub account revealed activity going back to 2016 under a Chinese username ("Chang") before changing to "Kohei Mizuno" in October 2024. The original Japanese individual was active until July 2024; around September 2024, the account was likely purchased or acquired by North Korean workers. Following the takeover, posting on X ceased and development abruptly pivoted to web engineering. - **Ongoing Operations**: Korei noted cases where accounts previously exposed via infostealer malware leaks continued to actively receive work on Japanese platforms, demonstrating gaps in vendor screening.

### Takeaways North Korean IT workers demonstrate high adaptability by targeting non-English ecosystems, manipulating crowdsourcing reputation systems, and even infiltrating local startups. However, their reliance on machine translation and templated personas creates clear forensic indicators. Platform operators must adopt stricter identity verification and proactive screening to disrupt these fraudulent operations.