Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThe U.S. Treasury Department said on March 12, 2026, that the Office of Foreign Assets Control (OFAC) sanctioned six people and two entities tied to schemes in which North Korean IT workers used deceptive identities to obtain overseas work and generate revenue for the regime. Treasury said the schemes generated nearly $800 million in 2024. The action highlights a network that can include workers, identity and payment facilitators, front companies, and procurement links—not just individual remote contractors.
How the schemes work
The U.S. government describes a pattern in which DPRK workers seek freelance or other IT contracts while posing as non-North Korean nationals, including people claiming to be based in the United States. The May 16, 2022 interagency advisory from the Departments of State and the Treasury and the FBI says they may use false personas and documents, stolen identities, overseas contacts, or subcontractors to secure work and communicate with customers.
The advisory says the work can involve in-demand skills such as software and mobile-app development. Its 2022 account identified China and Russia as primary locations, with smaller numbers in Africa and Southeast Asia; that is a dated description, not a verified map of worker locations in 2026. It characterized the DPRK as dispatching “thousands” of IT workers, without giving a more precise count in the cited passage.
Hiring deception is one part of a wider financial chain. Treasury’s 2025 and 2026 releases describe case-specific examples involving overseas facilitators, front companies, currency conversion, and wage remittances. Those accounts should not be treated as a universal blueprint for every scheme or as proof that every DPRK-linked contractor undertakes the same activities.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall#1 Best Overall
What Treasury sanctioned
The enforcement actions below show different alleged roles in the networks. They are Treasury’s descriptions of particular cases; they do not establish that every IT worker scheme has the same structure.
| Date | Treasury’s account | Network roles described |
|---|---|---|
| March 12, 2026 | OFAC sanctioned six individuals and two entities connected to DPRK government-orchestrated IT worker schemes targeting U.S. businesses. Treasury reported nearly $800 million generated by such schemes in 2024. | Treasury described Amnokgang Technology Development Company as managing overseas IT worker delegations and illicit procurement activity. The release also described financial facilitators and North Korean workers operating from Boten, Laos. |
| July 24, 2025 | Treasury described Korea Sobaeksu Trading Company as a front company for the Munitions Industry Department. | The release said the company had a role in sending IT worker teams overseas and in nuclear procurement activity, and described associated facilitators. |
| July 8, 2025 | Treasury described a Russia-based scheme involving Gayk Asatryan and companies that contracted to host DPRK IT workers, as well as a separate facilitator linked to a DPRK cyber actor. | The account involved companies hosting workers and financial or other facilitation; it is a case-specific description. |
The nearly $800 million figure is Treasury’s March 12, 2026 estimate for revenue generated in 2024 by DPRK government-orchestrated IT worker schemes. It is not an independently verified total in the cited materials, nor an amount attributed solely to the named 2026 network.
For the contemporaneous entries associated with the March 2026 action, OFAC’s March 12, 2026 designation update is the relevant list record. Sanctions lists can change, so a designation’s current status should be checked against OFAC’s live list rather than inferred from a past announcement.
IT contracting is not automatically cyber intrusion
The 2022 interagency advisory distinguishes the revenue-generating IT work from cyber operations. It also warns that privileged access obtained through contractor work has enabled intrusions in some cases. Treasury’s later releases describe some instances involving malware, attempts to extract sensitive or proprietary data, or extortion using sensitive data.
Rank #3
These are documented risks in some cases, not an inevitable result of hiring a remote developer or any person of a particular nationality. Treasury Secretary Scott Bessent said in the March 12, 2026 release that the regime targets U.S. companies through deceptive schemes and that operatives weaponize sensitive data and extort businesses for substantial payments. That statement describes the government’s characterization of the threat, not a finding about every contractor or every case.
What employers and platforms can do
The 2022 interagency advisory is addressed to employers, freelance platforms, payment services, and the public. It contains a fuller set of red flags and mitigation measures than can be reduced to a single screening trick. Treasury’s March 2026 announcement also points readers to the advisory and an FBI public service announcement for current tactics and network-protection steps.
- Use identity and work-authorization verification appropriate to the role and applicable law; treat inconsistencies in identity, location, credentials, or payment details as reasons to investigate rather than as proof on their own.
- Apply normal contractor controls: limit access to the systems and data needed for the work, monitor privileged access, and use established security and payment-review procedures.
- Review the relevant counterparty and payment chain, including intermediaries where appropriate. A worker, account holder, contracting company, and recipient of funds may not be the same person or entity.
- Do not use nationality, accent, geography, or remote work alone as a basis for suspicion. Focus on verifiable identity, documentation, access, and financial patterns.
- Consult the full interagency advisory for its detailed indicators and mitigation guidance; the short list above is not a substitute for it.
What an OFAC designation means for U.S. persons
Treasury’s sanctions notices explain that property and interests in property of designated persons that are in the United States, or in the possession or control of U.S. persons, must be blocked and reported. U.S. persons generally may not transact with blocked persons unless an OFAC license or exemption applies. The notices also describe the 50 Percent Rule: an entity owned, directly or indirectly, 50 percent or more in aggregate by one or more blocked persons is itself treated as blocked, even if it is not separately named on the list.
Violations may lead to civil or criminal penalties; Treasury notes that civil penalties can apply on a strict-liability basis. This is a general explanation, not a determination about a particular transaction. Sanctions status, applicable regulations, licenses, exemptions, ownership, and the facts of a transaction all matter. Businesses and individuals facing a potential match or blocked-property issue should consult current OFAC authorities and qualified legal counsel before acting.
Recommended Free Tools
Best Value
Sources and scope
This account reflects U.S. government materials: the May 16, 2022 joint State Department, Treasury, and FBI advisory; Treasury’s July 8 and July 24, 2025 sanctions announcements; and Treasury’s March 12, 2026 announcement and OFAC designation update. The allegations, designations, and revenue estimate described here are attributed to those agencies and are not independently verified in this article.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
