North Korean IT hiring fraud network hit with Treasury sanctions

The U.S. Treasury’s Office of Foreign Assets Control imposed sanctions on six individuals and two entities tied to a North Korean government-run IT network that placed operatives in jobs at American firms. The action includes Amnokgang Technology Development Company and warns financial institutions about exposure to related transactions.

According to OFAC, DPRK IT workers obtained remote roles at U.S. and other Western companies by using stolen identities, false resumes and fabricated client references. Most of the earnings were routed to the North Korean state. Treasury indicated the designations are intended to disrupt funding tied to North Korea’s weapons programs and to deter intermediaries from enabling the schemes.

Treasury identified Amnokgang Technology Development Company as an IT firm that manages delegations of North Korean workers abroad. The action also reaches facilitators and proxies in Southeast Asia who handled accounts and moved money for those workers. OFAC noted that foreign financial institutions that knowingly facilitate transactions for designated parties risk penalties under secondary sanctions authorities.

Case details in the announcement include the CEO of Quangvietdnbg International Services, who converted about $2.5 million into cryptocurrency for North Korean clients between mid-2023 and mid-2025. DPRK national Yun Song Guk operated freelance IT services from Boten, Laos, coordinating more than $70,000 in transactions. Vietnamese nationals Do Phi Khanh and Hoang Van Nguyen acted as proxies to launder IT worker proceeds for a sanctioned North Korean procurement facilitator. Treasury also linked Do Phi Khanh to a counterfeit cigarette deal valued at over $200,000.

According to OFAC, the scheme relied on stolen or borrowed identities and doctored documents to place operatives in software development, crypto services, and other digital roles. In some cases, those workers allegedly moved beyond payroll fraud by planting malware at victim firms and carrying out extortion, exposing companies to cyber intrusions and data theft.

The agency described an evolving playbook that now includes AI tools and fake video interviews used to impersonate applicants and get through routine screening. Those tactics have appeared at crypto companies and other tech businesses, where access to code and infrastructure can be monetized or used in later-stage intrusions.

OFAC also warned that foreign financial institutions could face secondary sanctions if they knowingly process transactions for the designated persons, putting their access to the U.S. financial system at risk. The exposure extends to cross-border payroll flows, contractor platforms, and payment channels often used by DPRK-linked IT workers, including routes through Southeast Asia.

Treasury urged employers and staffing firms to tighten identity checks in remote hiring and monitor developer activity for unusual behavior. It also called on financial institutions to review controls around payments for IT services, contract wages, and cryptocurrency conversions tied to the named parties.

Whistleblowers who submit tips on potential sanctions violations to the Financial Crimes Enforcement Network may be eligible for awards tied to successful enforcement actions above $1 million.

The sanctions take effect immediately. Property and interests in property of the designated individuals and entities within U.S. jurisdiction, or in the possession or control of U.S. persons, are blocked. U.S. persons are generally barred from transactions with the listed parties, and companies with potential exposure are expected to assess and address any related activity.