OFAC SANCTIONS DPRK IT WORKER NETWORK FUNDING WMD PROGRAMS THROUGH FAKE REMOTE JOBS

Summary from the TLDR InfoSec newsletter

OFAC sanctioned six individuals and two entities tied to the DPRK IT worker scheme (Coral Sleet/Jasper Sleet/Wagemole), which uses stolen identities, AI-generated personas, and Faceswap-altered documents to place North Korean operatives at Western companies, funneling salaries back to fund WMD programs. The operation runs through a multi-tiered structure of recruiters, facilitators, and western collaborators sourced via LinkedIn and GitHub, with operators tunneling traffic through Astrill VPN's US exit nodes from China-based infrastructure to masquerade as domestic employees. Post-access activity included proprietary data theft, extortion, and the use of agentic AI to generate and refine malware components. Microsoft has advised defenders to treat these intrusions as insider-risk scenarios and to monitor for abnormal credential use and low-and-slow access patterns.