OFAC Sanctions DPRK IT Worker Network Tied to WMD Funding
Summary
OFAC sanctioned six individuals and two entities tied to a DPRK IT-worker scheme that allegedly uses fraudulent identities to secure jobs, funnel revenue to North Korea, and sometimes steal data or extort employers.
Key points
- OFAC sanctioned six individuals and two entities for involvement in a scheme intended to defraud U.S. businesses and generate revenue for North Korea’s WMD programs.
- The scheme, also called Jasper Sleet, Coral Sleet, PurpleDelta, and Wagemole, uses fabricated identities, bogus documents, and collaborators to obtain legitimate remote jobs.
- The article says salaries are funneled to North Korea; in some cases, operators use malware to steal sensitive or proprietary data and demand ransoms to prevent its public release.
- LevelBlue says operatives use Astrill VPN and U.S. exit nodes while working from countries such as China to disguise their location. It also describes a remote hire terminated after logins consistently indicated China.
- Microsoft says AI tools, including Faceswap and jailbroken LLMs, have been used to fabricate identities, create fake company websites, and develop or modify malware.
- A report from Flare and IBM X-Force describes a structure of recruiters, facilitators, IT workers, and collaborators, and notes the use of timesheets, IP Messenger, and Google Translate.
Article Details
- Event Type
- OFAC sanctions against individuals and entities linked to a DPRK IT worker fraud and cyber-extortion scheme.
- Impact
- The scheme uses fabricated identities to obtain employment and sustained access to businesses, and in some cases steals sensitive data and demands ransoms or threatens public disclosure. The article says proceeds are funneled to North Korea to support WMD programs; it reports that one company converted an estimated $2.5 million into cryptocurrency between mid-2023 and mid-2025.
MITRE ATT&CK
People
Do Phi KhanhDescribed as an associate of Kim Se Un who allegedly let Kim use his identity to open bank accounts and launder IT-worker proceeds.Hoang Minh QuangNamed as a party to financial transactions with Yun Song Guk relating to IT services.Hoang Van NguyenThe article says he assisted Kim Se Un in opening bank accounts and enabled cryptocurrency transactions.Kim Se UnThe article says Do Phi Khanh and Hoang Van Nguyen assisted him with bank accounts and financial transactions, and notes that he was sanctioned by the U.S. in July 2025.Nguyen Quang VietCEO of Quangvietdnbg International Services Company Limited; the article says the company facilitated currency conversion for North Koreans.Scott BessentU.S. Treasury Secretary who commented on the sanctions and the threat to American companies.Tue LuuSecurity researcher quoted describing the operators’ use of VPNs and their locations.York Louis Celestino HerreraThe article says Yun Song Guk worked with him to develop freelance IT-service contracts.Yun Song GukDescribed as a North Korean national who led IT workers conducting freelance work from Boten, Laos, and coordinated financial transactions and IT-service contracts.
Threat Actors
Contagious InterviewIdentified in the article as a Lazarus Group subgroup that relies on VPN capabilities to access the global Internet, manage command-and-control infrastructure, and mask its location.Coral SleetThe article identifies Coral Sleet as another name for the DPRK IT worker scheme also called Jasper Sleet, PurpleDelta, and Wagemole.Jasper SleetThe article describes Jasper Sleet as using AI-assisted identity fabrication and long-term access in the DPRK IT worker scheme. It identifies the scheme by the names Coral Sleet, PurpleDelta, and Wagemole.Lazarus GroupThe article says Lazarus Group subgroups rely on VPN capabilities to access the global Internet, manage command-and-control infrastructure, and mask their location.PurpleDeltaThe article identifies PurpleDelta as another name for the DPRK IT worker scheme also called Coral Sleet, Jasper Sleet, and Wagemole.WagemoleThe article identifies Wagemole as another name for the DPRK IT worker scheme also called Coral Sleet, Jasper Sleet, and PurpleDelta.
Products
AstrillThe operation uses fake identities, AI-enabled persona fabrication, VPNs like Astrill, and malware-driven extortion to gain sustained access to companies and evade detection.ChatGPTto translate job descriptions, craft applications, and even interpret responses from tools like ChatGPT.FaceswapThreat actors leverage AI tools (including Faceswap and jailbroken LLMs) and VPN services like Astrill to fabricate identities and conceal locations.Google Translateand work progress, IP Messenger (aka IPMsg) for decentralized internal communication, and Google Translate to translate job descriptions, craft applications, and even interpret responses from tools likeIP Messengercome to light that the threat actors use timesheets for tracking job applications and work progress, IP Messenger (aka IPMsg) for decentralized internal communication, and Google Translate to translate jobSalesforceThe IT worker, who was hired on August 15, 2025, as a remote employee to work on Salesforce data, was terminated 10 days later after exhibiting indicators showing consistent logins from China.
Countries
ChinaThe development comes as LevelBlue highlighted the IT worker scheme’s use of Astrill VPN to conduct their operations while located in countries like China, owing to the service’s ability to bypass China’s Great Firewall.LaosYun Song Guk, a North Korean national who led a group of IT workers conducting freelance IT work from Boten, Laos, since at least 2023.North Koreabusinesses and funnels illicit revenue to fund North Korea’s WMD programs.United StatesThe U.S. Treasury’s OFAC sanctioned six individuals and two entities for operating a DPRK IT worker scheme that defrauds U.S.