Threats · 224 days ago
The U.S. Treasury sanctioned six individuals and two entities tied to a DPRK remote IT-worker scheme that embeds operatives in Western firms and funnels pay to Pyongyang. The network siphons salaries and stolen data to finance North Korea's missile and WMD programs; UN estimates annual revenue near $500 million. IBM and Flare research outlines a hierarchical recruitment model and Western brokers used to recruit and conceal operatives.
4 sources covering this story
Trio sentenced for facilitating North Korean IT worker scheme from their homes
companies by hosting laptop farms and helping remote IT workers assume fake identities.
Elite members of North Korean society fake their way into Western paychecks - Help Net Security
North Korean IT workers carry out corporate infiltration through remote jobs, using fake identities, collaborators, and job cycling.
OFAC Sanctions DPRK IT Worker Network Funding WMD Programs Through Fake Remote Jobs
OFAC sanctions DPRK IT fraud network using fake jobs and AI tactics, exposing funding links to WMD programs and insider threats.
New research unpacks North Korea’s stealthy, sophisticated remote IT worker schemes
The report recommends that businesses practice several forms of vigilance to avoid unwittingly hiring Pyongyang’s operatives.
Part of the PlainSec briefing for 2026-03-19