TLDR Tech / InfoSec
OFAC Sanctions DPRK IT Worker Network Funding WMD Programs Through Fake Remote Jobs
OFAC sanctioned six individuals and two entities tied to the DPRK IT worker scheme (Coral Sleet/Jasper Sleet/Wagemole), which uses stolen identities, AI-generated personas, and Faceswap-altered documents to place North Korean operatives at Western companies, funneling salaries back to fund WMD programs. The operation runs through a multi-tiered structure of recruiters, facilitators, and western collaborators sourced via LinkedIn and GitHub, with operators tunneling traffic through Astrill VPN's US exit nodes from China-based infrastructure to masquerade as domestic employees. Post-access activity included proprietary data theft, extortion, and the use of agentic AI to generate and refine malware components. Microsoft has advised defenders to treat these intrusions as insider-risk scenarios and to monitor for abnormal credential use and low-and-slow access patterns.
Read the full story