U.S. Sanctions North Korea Scheme Using Remote Workers

U.S. authorities have unveiled new sanctions targeting six individuals and two companies suspected of aiding North Korea in a sophisticated scheme to funnel illicit funds into the regime’s weapons programs. The Treasury Department’s Office of Foreign Assets Control revealed these measures, announced by CBS News on Thursday, following years of investigation.

The sanctioned entities were involved in running a global operation that used remote IT workers from across Asia and Europe as front men for Pyongyang’s military and industrial efforts. These individuals and companies are accused of posing as legitimate tech experts to secure jobs at numerous corporate giants through fraudulent means such as stolen identities and forged documents, thus enabling them to siphon off significant financial gains.

The scheme is estimated to have netted nearly $800 million in 2024 alone, with a considerable portion diverted towards North Korea’s nuclear development. Authorities allege that some of these IT workers inadvertently deployed malware into company networks, further compromising sensitive or proprietary information and aiding the operation’s success rate.

Thursday’s sanctions encompassed North Korean companies like Amnokgang Technology Development Company and Vietnam-based Quangvietdnbg International Services, as well as overseas entities in Laos and Spain. The U.S. Treasury also sanctioned Nguyen Quang Viet, CEO of Quangvietdnbg, for his involvement in converting $2.5 million into cryptocurrency from 2023 to 2025, sourced through the IT-worker plot.

Additionally, several other accomplices associated with Kim Se Un, a previously sanctioned facilitator of North Korean nuclear procurement, were penalized under these sanctions. The Treasury highlighted Yun Song Guk’s leadership role in orchestrating illicit payments and contracts for foreign partners involving freelance IT workers operating out of Boten, Laos.

Previously, CBS News exposed hiring practices at a Houston tech firm linked to the same infiltration effort. Now, further sanctions aim to disrupt this global network by blocking any financial interests belonging to these designated individuals and entities within U.S. jurisdiction or under control of U.S. persons. Transactions with sanctioned organizations are prohibited for U.S. citizens and companies alike.

These measures follow ongoing warnings from U.S. officials that North Korea continues to rely on sophisticated cyber operations, particularly those utilizing remote technology work, to bolster its nuclear and missile programs financially.