OFAC Sanctions DPRK IT Worker Network Funding WMD Programs Through Fake Remote Jobs

"The North Korean regime targets American companies through deceptive schemes carried out by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments. The fraudulent scheme relies on bogus documentation, stolen identities, and fabricated personas to help the IT workers obscure their true origins and land jobs at legitimate companies in the U.S. and elsewhere."

"A disproportionate portion of the salaries is then funneled back to North Korea to facilitate the nation's missile programs in violation of international sanctions. In some cases, these efforts are complemented by the deployment of malware to steal proprietary and sensitive information, as well as engaging in extortion efforts by demanding ransoms in return for not publicly leaking the stolen data."

"Amnokgang Technology Development Company, an IT company that manages delegations of overseas IT workers and conducts other illicit procurement activities to obtain and sell military and commercial technology through their overseas networks, was among the entities targeted by the latest round of OFAC sanctions."

The U.S. Treasury Department's Office of Foreign Assets Control sanctioned six individuals and two entities involved in a North Korean scheme using IT workers to defraud American companies and generate revenue for the regime's weapons programs. The operation, known by multiple names including Coral Sleet, Jasper Sleet, PurpleDelta, and Wagemole, employs fake documentation, stolen identities, and fabricated personas to disguise workers' origins and secure employment at legitimate U.S. and international companies. Salaries are funneled back to North Korea to support missile development. The scheme also involves deploying malware to steal proprietary information and conducting extortion by threatening to leak stolen data unless ransoms are paid.

Read at The Hacker News