OFAC Sanctions DPRK IT Worker Network Funding WMD Programs Through Fake Remote Jobs

OFAC sanctioned six individuals and two entities linked to a DPRK IT worker scheme that defrauds U.S. companies to fund North Korea's WMD programs.

• •The scheme uses stolen identities, fake personas, and AI tools like Faceswap to fabricate documents and resume headshots for job applications.
• •IT workers operate primarily from China, using Astrill VPN to tunnel traffic through U.S. exit nodes to appear as domestic employees.
• •Jasper Sleet leverages agentic AI to create fake company websites, generate malware, and jailbreak LLMs, lowering technical barriers at scale.
• •A multi-tiered structure involves recruiters, facilitators, IT workers, and western collaborators recruited via LinkedIn and GitHub.
• •Microsoft advises treating fraudulent employment as an insider-risk scenario, focusing on abnormal credential use and low-and-slow access patterns.