The sign gives little away and when asked, residents say they only know the venue sells “Korean food”.

The Paektu Hanna Restaurant in Laos’s capital Vientiane keeps a low profile these days. Named after the mountain in which former Democratic People’s Republic of Korea (DPRK) leader Kim Jong Il was born – according to Pyongyang’s party mythology – it is one of four North Korean restaurants that continue to operate in the Southeast Asian country even though they should have shut their doors long ago.

There were once an estimated 130 North Korean state-run restaurants in big cities across East and Southeast Asia – and even as far afield as Dubai and Amsterdam – offering a choreographed glimpse of life in the repressive state for curious tourists.

Today, only an estimated 17 remain in China, Russia and Laos, plus a single restaurant in the Vietnamese capital Hanoi, operating in violation of United Nations sanctions that came into full force in December 2019.

The outlets once provided a steady stream of revenue for the North Korean regime but their heyday has long passed. When Al Jazeera visited the Paektu Hanna on two occasions in August, only a handful of diners sat in the cavernous hall. On visits to Laos’s three other establishments on various nights, they were faring little better, with few to no customers.

While previously serving as nationalistic soft-power vehicles promoting North Korean culture abroad, today, the restaurants in Laos downplay their links to Pyongyang. Their role as cultural envoys diminished and with them generating scant revenue for the regime, their place in North Korea’s overseas business empire has only grown more opaque.

Accompanying this demise are reports of North Korean “IT workers” stationed in China, Russia and Laos. Experts told Al Jazeera that illicit funds generated through cybercrime have become a lifeline for North Korea and that the restaurants may be playing a crucial supporting role.

“It would be my number one guess that the restaurants are only there to launder money now,” Joshua Stanton, a lawyer in Washington, DC who helped draft the United States’s North Korea Sanctions and Policy Enhancement Act of 2016, told Al Jazeera.

“And one of the best sources of money that they could be getting is from those IT workers [in Laos]. It would make perfect sense.”

On December 22, 2017, the UN Security Council (UNSC) unanimously adopted the most far-reaching sanctions yet against Pyongyang in response to its launch of an intercontinental ballistic missile a month earlier. Security Council Resolution 2397 further restricted trade between North Korea and UN member states. It also called for the closure of North Korean businesses and the repatriation of all workers by December 2019.

But weak compliance, most notably from UNSC permanent members China and Russia, has undermined their effectiveness. China, North Korea’s main patron, has been accused of widespread sanctions violations, including employing up to 100,000 North Koreans across various industries. Russia, a growing ally of Pyongyang, has faced accusations of engaging in weapons deals and hosting 3,000-4,000 North Korean labourers, among them IT and construction workers.

‘More than restaurants’

On paper at least, the Lao government has expressed its commitment to adhering to the sanctions, saying in April 2018 in its mandatory UN implementation report that it had no business ties to Pyongyang and that authorisations for North Korean workers “will expire by the end of 2018 and will not be renewed.”

But in March 2020, Lao foreign ministry officials and a North Korean delegation were photographed being serenaded at the Paektu Hanna Restaurant, as they celebrated signing an “Agreement on Cooperation”.

Laos’s known contingent of North Korean workers is small –100 to 200 according to an RFA report in late 2022 – but the failure to repatriate them and close businesses has been noted in successive Panel of Experts reports for the UN’s 1718 Sanctions Committee, which monitors North Korean sanctions compliance.

Explaining this, Stanton points to the country’s close relationship with Beijing. “Laos borders China, they have very close economic and political relations with China,” he said. “And China does not fundamentally have a problem with North Korea proliferating, it has an interest in preserving North Korea as a bargaining chip.”

The Lao Ministry of Foreign Affairs could not be reached for comment.

This lack of adherence is on full display a 10-minute drive from the Paektu Hanna, in the basement of the upscale Landmark Riverside Mekong Hotel.

When Al Jazeera visited the Yue Yuan Chinese Restaurant, two waitresses confirmed they were from North Korea, while there was North Korean food and Korea Mannyon Health Corporation products on sale, including internationally prohibited tiger bone liquor.

A third restaurant in the capital, Sindat BBQ – a drab low-rise building with tinted windows and sleeping quarters above – was open but empty on two visits, with only Korean-speaking staff hanging around. It was known as the Pyongyang Restaurant until rebranding in 2022 and now makes no reference to its country of origin beyond a fridge stocked with North Korean alcohol.

Messaging in Lao to a number listed on the shop sign, Al Jazeera was connected to the “owner”—a Whatsapp account with Korean in its bio. The Korean account did not respond to several messages in different languages.

In Vang Vieng, the backpacker town about 130km (81 miles) north of Vientiane, the Pyongyang Restaurant has also been renamed Sindat BBQ. It also had no customers on one Saturday evening, with the Korean-speaking staff saying they would not be putting on the scheduled performance.

To the casual observer, they may appear to be simply failing businesses on their last legs, but Remco Breuker, a professor of Korean studies at Leiden University in the Netherlands who has studied the use of forced North Korean labour in Europe, said that while the customers have dried up, “these restaurants are always more than just restaurants”.

“[Behind an embassy], a restaurant works best as a home base to take care of North Korean foreign workers. They’re places to stash the passports, to keep the money,” he told Al Jazeera. “These restaurants are extremely important in that sense.”

Recent years have seen North Korean IT workers stationed in China, Russia and increasingly Laos, linked with hacks, malware, and cryptocurrency theft – the proceeds from which have been funnelled back to the regime.

In 2022, the UN Panel of Experts documented the case of North Korean national Oh Chung Song, a resident of Dubai who, along with a number of other North Korean IT workers, concealed their identities to use the platform Upwork to undertake freelance work. When their true identities were uncovered in December 2021, they fled to Laos fearing an investigation by United Arab Emirates authorities.

In May, the US Treasury’s Office of Foreign Assets Control and the South Korean Ministry of Foreign Affairs separately sanctioned six entities and seven individuals responsible for deploying North Korean IT workers to China, Russia and Laos for the purposes of malicious cyber-activities. In Laos, this included the Chinyong IT Cooperation Company and the Laos-based Tongmyong Technology Trade Company, along with two in-country representatives.

The US Treasury estimated each IT worker was able to earn “more than $300,000 per year”, which they said directly contributed financing to North Korea’s “WMD and ballistic missile programs”.

Stanton said IT workers in Laos would probably be hacking, stealing cryptocurrency and planting malware, the proceeds from which are “good for nothing” until they pass through North Korea’s elaborate money-laundering network, “which, at its outer fringes, involves things like restaurants in Laos”.

The intermingling of North Korean restaurants with illicit cyber-activities is not unheard of. In 2019, two US think tanks said the Koryo Restaurant in Hanoi was a front for IT sales, including facial recognition software. The restaurant remains open despite the allegations.

A diplomatic source with close knowledge of North Korea told Al Jazeera it was “very difficult to say” whether restaurants in Laos might be doing the same but there had been a “clear rise in cybercrimes and cyber-theft” through their work since about 2019, with it now overshadowing traditional sources of income like coal, restaurants and worker remittances.

“The financial income from cybercrime has increased substantially,” said the diplomat, who declined to be identified because of the sensitivities. “There are indications that this is becoming the most important source of income for the DPRK.”

North Korean cybercriminals have grown in sophistication and reach in recent years, with US-based blockchain firm Chainalysis saying in February that North Korean-linked hackers “shattered their own yearly record for most cryptocurrency stolen” in 2022 with their $1.7bn haul.

Breuker of Leiden University said the increase was “directly linked” to UN sanctions hitting what was a “stable, lucrative form of foreign income” in overseas workers and businesses. He said he believed it was possible that revenue from IT workers in places like China, Russia and Laos were “keeping the regime alive”.

“Without cyber-attacks, we would be in a very different situation with North Korea,” he said. “We might even be in a situation where we could actually talk to them.”

Additional reporting by Lamxay Duangchan