The U.S. Treasury sanctioned six people and two entities tied to a DPRK remote IT-worker scheme that embeds operatives in Western firms via fake job offers. The network funnels salaries back to Pyongyang to finance WMD programs using stolen identities, recruiters, brokers, messaging apps and cryptocurrency conversion. IBM and Flare research outlines the operation’s hierarchy; UN reporting pegs revenue near $500M annually.
Part of the PlainSec briefing for 2026-03-22