US Treasury sanctioned North Korea's FFTDC and 10 others over IT worker fraud that used AI tools to pass US hiring screens
The U.S. Treasury Department designated 11 individuals and entities for helping North Korea's overseas IT worker scheme collect nearly $800 million in salary payments from American employers in 2024. The sole entity designated, the First Financial and Technical Development Center (FFTDC), deployed what Treasury calls 'Super Intelligence (SI) tools', AI systems that workers use to bypass employer hiring controls. Six IT workers in FFTDC's network, who collectively earned at least $750,000 for the Center, were also designated. For the first time, OFAC also designated Russian nationals for laundering the scheme's earnings.
What the AI did
People working in North Korea's overseas IT worker scheme used AI tools, which the US Treasury calls "Super Intelligence (SI) tools" and which were supplied by the front company FFTDC, to get past American employers' hiring controls. Applicants using these AI tools reportedly got through standard background checks and video interviews.
First reported October 28, 2026 · Added to the register November 6, 2026 · 1 source
- Deployer
- First Financial and Technical Development Center (FFTDC)
- Affected
- American employers
- Country
- United States
- When it happened
- October 28, 2026
- First reported
- October 28, 2026
What this means for you
Could this affect you?
If you hire remote technical staff. US and allied employers hiring remote technical staff, especially in software, mobile engineering and database roles, were targeted, and paying these workers, even unknowingly, can bring sanctions penalties that apply regardless of intent.
What to check
- Require in-person or third-party supervised identity checks for remote technical hires before shipping devices.
- Use hardware-binding controls that stop work laptops being controlled remotely through KVM devices, which let someone elsewhere operate the computer.
- Audit payroll, IP addresses and device logs for signs that workers are not where they claim to be.
- Screen payments against the updated US sanctions list, including payments through Russian contractors.
Areas of your AI programme this touches
Timeline
- October 28, 2026Happened
- October 28, 2026First reported
Every fact and its source (6)
- Date of Treasury sanctions action2026-10-28“formally identified in the October 28 action as active money launderers”[1]
- Parties designated11 individuals and entities“designated 11 individuals and entities for helping North Korea's overseas IT worker scheme”[1]
- Earnings of six designated IT workers for FFTDCat least $750,000“those six individuals collectively earned at least $750,000 on the Center's behalf since 2025”[1]
- Legal basis for FFTDC designationExecutive Order 13722“FFTDC and the six individual IT workers were designated under Executive Order 13722”[1]
- Salary payments collected by scheme in 2024nearly $800 million“collect nearly $800 million in salary payments from American employers in 2024”[1]
- AI tools named in Treasury designationSuper Intelligence (SI) tools“has equipped its workers with what Treasury's official designation calls "Super Intelligence (SI) tools"”[1]
Sources
- North Korea's $800M IT Fraud Ring Used AI to Pass Hiring Screens; Russia Sanctionedtechtimes.com · October 29, 2026
How this record is classified. Severity N: a legal action or test finding, not a harm. Evidence: Confirmed, meaning a company, official or court statement.
The facts in At a glance and in Every fact and its source are quoted from the sources listed. The summary, What the AI did and What this means for you are written from those sources and checked against them automatically before publication. Records reflect what has been disclosed, not everything that has happened. Incidents are found through news feeds and the GDELT Project.
