Threats · 179 days ago
The U.S. Treasury sanctioned six people and two entities tied to a DPRK remote IT-worker scheme that embeds operatives in Western firms via fake job offers. The network funnels salaries back to Pyongyang to finance WMD programs using stolen identities, recruiters, brokers, messaging apps and cryptocurrency conversion. IBM and Flare research outlines the operation’s hierarchy; UN reporting pegs revenue near $500M annually.
4 sources covering this story
Trio sentenced for facilitating North Korean IT worker scheme from their homes
companies by hosting laptop farms and helping remote IT workers assume fake identities.
Elite members of North Korean society fake their way into Western paychecks - Help Net Security
North Korean IT workers carry out corporate infiltration through remote jobs, using fake identities, collaborators, and job cycling.
OFAC Sanctions DPRK IT Worker Network Funding WMD Programs Through Fake Remote Jobs
OFAC sanctions DPRK IT fraud network using fake jobs and AI tactics, exposing funding links to WMD programs and insider threats.
New research unpacks North Korea’s stealthy, sophisticated remote IT worker schemes
The report recommends that businesses practice several forms of vigilance to avoid unwittingly hiring Pyongyang’s operatives.
Part of the PlainSec briefing for 2026-03-22