Trump Admin Targets Communist Weapons Scheme Allegedly Defrauding US Firms

The Trump administration slapped sanctions on six individuals and two companies Thursday for allegedly assisting North Korea in running government-orchestrated information technology (IT) worker schemes that “targeted” U.S. companies.

These alleged global IT worker schemes systematically defrauded American businesses and generated revenue to help fund North Korea’s weapons of mass destruction (WMD) programs, including nearly $800 million in 2024 alone, according to an announcement from the Treasury Department’s Office of Foreign Assets Control (OFAC). 

“The North Korean regime targets American companies through deceptive schemes carried out by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments,” Treasury Secretary Scott Bessent said in a statement. “Under President [Donald] Trump’s leadership, Treasury will continue to follow the money in order to protect U.S. businesses from these malicious activities and ensure those responsible are held accountable.”

IT teams facilitated by North Korea often utilize fraudulent documentation, stolen identities and fake personas in order to hide their true identities and secure employment at legitimate companies, including those based in the U.S., per the news release. Moreover, the North Korean government reportedly allocates most of the wages earned by these overseas IT workers, which produces hundreds of millions of dollars to support the regime’s WMD and ballistic missile programs. This violates U.S. and United Nations sanctions, according to the Treasury Department.

Thursday’s sanctions target several IT worker networks based in North Korea, Vietnam, Laos and Spain, according to the announcement.

One of the companies hit with sanctions is Amnokgang Technology Development Company, a North Korean IT firm that manages delegations of overseas workers and conducts other alleged “illicit procurement activities to obtain and sell military and commercial technology through its overseas networks,” according to the announcement.

The Trump administration also said it is sanctioning Nguyen Quang Viet, CEO of Vietnam-based Quangvietdnbg International Services Company Limited, a company based in Vietnam. Nguyen allegedly converted approximately $2.5 million into cryptocurrency for North Koreans from mid-2023 to mid-2025, which included converting illicit earnings from IT workers associated with Amnokgang, according to the news release.

Moreover, the U.S. government also sanctioned Do Phi Khanh, an associate of U.S.-sanctioned North Korean nuclear procurement facilitator Kim Se Un, who allegedly acted “as Kim’s proxy and likely allows Kim to use his identity to open bank accounts and launder proceeds from DPRK IT workers,” according to OFAC. Hoang Van Nguyen also helped Kim open bank accounts, facilitated cryptocurrency transactions for Kim and worked alongside him to obtain foreign currency for the North Korean regime, OFAC alleges.

Additionally, OFAC sanctioned North Korean national Yun Song Guk, whom it alleges led a group of North Korean IT workers conducting freelance IT work from Boten, Laos since at least 2023, according to the announcement.

The move comes as U.S. government officials have repeatedly warned that North Korea increasingly relies on cyber operations and remote technology work to obtain hard currency to help fund the development of its nuclear weapons and ballistic missile programs, CBS News reported on Thursday.

In November 2025, OFAC sanctioned eight individuals and two entities for allegedly laundering funds derived from a spate of “illicit” North Korean schemes, including cybercrime and IT worker fraud, according to a press release.