U.S. Sanctions North Korean IT Worker Network Supporting Weapons of Mass Destruction Programs

The U.S. Treasury Department has taken decisive action against a shadowy network of North Korean IT workers accused of funneling illicit revenue to fund the country’s weapons of mass destruction (WMD) and ballistic missile programs. The Office of Foreign Assets Control (OFAC) recently sanctioned two individuals and four entities allegedly tied to schemes that exploit freelance IT work worldwide to generate income for the regime in violation of international sanctions.

North Korea’s Hidden IT Workforce

These North Korean IT workers, operating covertly under false identities, have been securing freelance contracts for tasks like software and mobile app development. While these workers earn wages from unsuspecting clients, the DPRK government reportedly withholds up to 90% of their income, channeling it into state coffers. This system is believed to generate hundreds of millions of dollars annually, directly supporting Pyongyang’s WMD ambitions.

OFAC’s sanctions target:

• Department 53 of The Ministry of the People’s Armed Forces, which oversees front companies generating IT-related revenue.
• Korea Osong Shipping Co. and Chonsurim Trading Corporation, both accused of maintaining DPRK IT workers in Laos since at least 2022.
• Liaoning China Trade Industry Co., Ltd, a Chinese company facilitating IT worker activities by providing essential equipment like computers and network tools.
• Jong In Chol and Son Kyong Sik, high-ranking individuals managing these illicit operations in Laos and China, respectively.

A Longstanding Illicit Scheme

The exploitation of overseas IT workers is not new. Similar activities were flagged as early as 2018 when OFAC sanctioned companies involved in exporting North Korean labor. These operations, now tracked under names like Famous Chollima, Nickel Tapestry, UNC5267, and Wagemole, gained broader attention in 2023 for their increasing focus on cryptocurrency and Web3 companies.

A Broader Cybersecurity Threat

North Korea’s IT workers not only generate revenue but also pose a serious security risk. Recent investigations revealed:

• Infiltration of Cryptocurrency Firms: Workers compromised networks, stole intellectual property, and demanded cryptocurrency in exchange for not leaking sensitive data.
• Insider Threats: Collaborators in countries like the U.S. have reportedly aided these schemes, including running “laptop farms” in exchange for monthly payments.
• Cyber Espionage: DPRK-linked hacking groups have historically targeted developers with malware-laden job offers to facilitate cryptocurrency theft and espionage.

A Global Push to Disrupt DPRK’s Revenue Streams

The U.S. government remains committed to dismantling these networks. Acting Under Secretary for Terrorism and Financial Intelligence, Bradley T. Smith, emphasized the importance of countering North Korea’s reliance on IT workers to fund its destabilizing activities, including its support for Russia’s war in Ukraine.

This crackdown is just one part of a broader effort to counter North Korea’s illicit financial operations, which include cryptocurrency theft and cyberattacks. Heightened awareness and sanctions are steps toward curtailing Pyongyang’s use of global IT markets to undermine international security.

As North Korea continues to exploit digital platforms and human labor for its WMD programs, businesses worldwide must remain vigilant. By enhancing due diligence and cybersecurity practices, organizations can help curb these covert operations, denying the regime access to critical funding streams.