North Korea has used an IT worker to clandestinely obtain remote work with a New Zealand business to earn foreign currency.

This was revealed in the latest annual report from the National Cyber Security Centre (NCSC) out on Thursday.

The national watchdog labelled this a "new" type of threat in a cyber hazards landscape that's changing faster than ever.

It said a large and reputable New Zealand business with good hiring practices nevertheless was duped for a while.

"We are aware across the world that one of North Korea's ways that they accumulate foreign cash is to use these ... remote IT workers, taking advantage of the ease of IT working nowadays to obfuscate where a person comes from - pretend that they're not from North Korea but from somewhere else - and try and get them jobs in Western companies," Catriona Robinson, head of the NCSC, told RNZ.

The North Korean worker used a false persona including fake identity documents, a New Zealand address as a contact point and recruited a New Zealand citizen to receive and operate the company's laptop.

But eventually the NZ firm got suspicious and police were called in.

The worker then claimed to have obtained commercially sensitive information and threatened to release this if not paid, said the annual report.

The NCSC told RNZ what occurred regarding that threat was an issue for the business and police, and it was unable to comment.

Robinson said the person paid to receive the laptop had been spoken to by police.

The scam put the company at risk of breaching United Nations sanctions.

Warning signs to watch out for included requests to be paid in cryptocurrency, refusal to participate in video-conference meetings and unusual working hours.

Ways to beat this included interviewing hirees face-to-face and requiring new staff to pick up IT equipment personally.

During the year, almost a quarter of incidents of potentially national significance had suspected state-sponsored links, said the annual report.

The links were to China, Russia, Iran and North Korea. China "is the most persistent and capable state actor undertaking cyber activity in New Zealand", it added.

The biggest threat ahead might be from malicious actors who by early next year were expected to have access to advanced AI models with supercharged hacking powers.

The NCSC had not anticipated a year ago that this threat would develop so fast, said Robinson.

"The fact that the frontier AI capabilities - in particular those agentic AI which can act for themselves - that moved a very great deal faster than we anticipated a year ago."

Some such models have broken out of what were meant to be secure test environments and hacked companies on their own volition this year.

Robinson said basic cyber security still held as the main means to combat the threats, from renewing old systems to patching software regularly.

"We're seeing an explosion in updates and patches coming through, everything from phones seemingly updating themselves every couple of days, through to the patching cycles that big software systems need to do, speeding up from needing to be done every few months to needing to be done every few weeks or even every week."

Another threat was social engineering.

The report gave an example of how online collaboration platforms had become another vector for social engineering compromise if they were not effectively locked down.

"In a case reported to the NCSC a contractor to New Zealand government organisations received an inauthentic 'helpdesk' call via Microsoft Teams.

"From there, actors socially engineered their access to the contractor's network and installed software that enabled them to evade malware detection and exfiltrate data."

Summit to find blockages

In the government sector, a summit is being called next month among core departments and agencies to test where they are at.

The 40 or so core public agencies recently reported back to the NCSC on how they measured up against the minimum cyber security standards it put out last year.

The centre refused to give specifics to RNZ but Robinson said, "We have work to do and we are doing it.

"We need to improve and we're doing work in the next month or so to bring all of the government's chief information security officers together to test where the systemic blockages are to making the improvements that we need."

Its advice to departments had been that old systems were less secure and the cloud more secure.

A government push to centralise how agencies adopted new IT was expected to improve cyber security. The upfront costs could be offset long term by greater efficiency, said a Treasury report last year.

However, the report also noted the way IT investment was managed did not recognise the ongoing costs of cyber security and that could get in the way of upgrades.

The centralised approach might help deal with that too, it said.