{"schema_version":"0.10.0","id":"LR-2026-0269","record_version":2,"title":"North Korean IT worker scheme uses FFTDC 'Super Intelligence' AI tools, deepfakes and voice manipulation to defeat U.S. hiring controls","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":44.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":4.48,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-29","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-10-29","history":[{"date":"2026-10-29","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"07f0a706242188b37d09a2a94d1c3dfe49137b461fe8c8733804d8f0ceef5ef3"},"system":{"model_name":"Super Intelligence (SI)","model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"production","tier":null,"lifecycle_stage":null,"integration_type":"embedded","intended_use":"To evade hiring controls: deepfake video overlays for job interviews, voice manipulation to replace North Korean accents, résumé generation tailored to applicant tracking systems, and chatbots to manage multiple jobs.","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-29","incident_class":"other","failure_class":null,"agent_involved":false,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Treasury sanctioned 11 people and entities tied to North Korea's overseas IT worker scheme, which collected nearly $800 million in U.S. wages in 2024. The FFTDC was designated for deploying 'Super Intelligence' AI tools, deepfake video and voice manipulation to evade hiring filters. Russian nationals were designated for laundering proceeds for the first time.","tags":["deepfake","hiring-fraud","sanctions","identity-fraud","north-korea"],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"third_party","adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"major: Treasury sanctioned 11 people and entities over a scheme that collected nearly $800 million in wages from U.S. employers, involving many third parties and a regulator.","harm_class":["financial","third_party_security"],"affected_description":"U.S. employers who paid wages to North Korean IT workers; companies targeted by the scheme","protected_class_involved":null,"data_categories_exposed":["pii"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://mx.ibtimes.com/north-korea-ai-hiring-fraud-sanctions-3482","publisher":"International Business Times","date":"2026-10-29","type":"press","title":"North Korean cyberfraud network used AI to beat hiring filters; Russia sanctioned","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.model_name":"D","system.integration_type":"D","system.intended_use":"C","system.developer":"D","system.deployment_context":"D","system.autonomy_level":"D","event.tags":"C","event.responsible_party":"C","event.adversarial_actor":"C","event.agent_involved":"D","event.incident_class":"D","event.summary":"C","event.date_disclosed":"A","event.trigger":"D","event.detection_method":"D","impact.harm_class":"C","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.severity":"D","context.regulatory":"C","context.denominator_available":"D","context.country":"C","impact.severity_because":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"The First Financial and Technical Development Center (FFTDC), designated on Wednesday, has equipped its workers with what Treasury officially calls “Super Intelligence (SI)” tools—AI systems used to evade hiring controls—along with deepfake video and real-time voice-manipulation capabilities documented by independent researchers."}],"system.developer":[{"source_index":0,"quote":"The First Financial and Technical Development Center (FFTDC), designated on Wednesday, has equipped its workers with what Treasury officially calls “Super Intelligence (SI)” tools—AI systems used to evade hiring controls—along with deepfake video and real-time voice-manipulation capabilities documented by independent researchers."}],"system.intended_use":[{"source_index":0,"quote":"AI generates résumés tailored to applicant tracking system (ATS) algorithms, treating the ATS as an adversarial puzzle to be solved rather than a screening process to be answered honestly."},{"source_index":0,"quote":"Once hired, AI chatbots help workers manage multiple jobs at the same time."}],"system.integration_type":[{"source_index":0,"quote":"During video interviews, real-time deepfake overlays replace their appearance and voice-manipulation tools conceal their accents."}],"system.deployment_context":[{"source_index":0,"quote":"Workers have passed technical hiring screens at legitimate U.S. technology companies, government contractors and financial services firms."}],"event.agent_involved":[{"source_index":0,"quote":"AI generates résumés tailored to applicant tracking system (ATS) algorithms, treating the ATS as an adversarial puzzle to be solved rather than a screening process to be answered honestly."}],"event.incident_class":[{"source_index":0,"quote":"North Korean operators build fraudulent identities using stolen or purchased data from U.S. citizens, combined with AI-generated profile photos and fake employment histories."}],"event.adversarial_actor":[{"source_index":0,"quote":"North Korean operators build fraudulent identities using stolen or purchased data from U.S. citizens, combined with AI-generated profile photos and fake employment histories."}],"event.responsible_party":[{"source_index":0,"quote":"North Korean operators build fraudulent identities using stolen or purchased data from U.S. citizens, combined with AI-generated profile photos and fake employment histories."}],"event.tags":[{"source_index":0,"quote":"A Cloud Security Alliance research note published in March 2026 found that about 25% of confirmed North Korea-linked applicants used real-time deepfake video overlays during job interviews."},{"source_index":0,"quote":"The U.S. Treasury Department on Wednesday sanctioned 11 people and entities that helped North Korea’s overseas IT worker scheme collect nearly $800 million in wages paid by U.S. employers during 2024."}],"impact.affected_description":[{"source_index":0,"quote":"The U.S. Treasury Department on Wednesday sanctioned 11 people and entities that helped North Korea’s overseas IT worker scheme collect nearly $800 million in wages paid by U.S. employers during 2024."}],"impact.harm_class":[{"source_index":0,"quote":"According to the OFAC designation of Kim Ki Hyok, he has transferred nearly $500,000 to North Korea on behalf of the delegation since 2024."},{"source_index":0,"quote":"Kim Hyo Dong leads a separate group of IT workers and is accused of providing logistical support and transferring financial assets worth more than $100,000 in an attempt to evade sanctions, according to the OFAC release."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"North Korean operators build fraudulent identities using stolen or purchased data from U.S. citizens, combined with AI-generated profile photos and fake employment histories."}],"context.country":[{"source_index":0,"quote":"Kim Ki Hyok, identified as a senior employee of Alis, leads a delegation of North Korean IT workers in Russia tasked with supervising employees and ensuring they meet revenue targets set by Pyongyang."}],"context.regulatory":[{"source_index":0,"quote":"The individual designations of Obertas, Boykov, Kim Ki Hyok and Kim Hyo Dong were made under Executive Order 13687, which authorizes sanctions against the North Korean government, the Workers’ Party of Korea and their agents and collaborators."},{"source_index":0,"quote":"The exposure operates under a strict-liability standard: U.S. sanctions law does not require intent or knowledge to establish a civil violation."}],"event.summary":[{"source_index":0,"quote":"The U.S. Treasury Department on Wednesday sanctioned 11 people and entities that helped North Korea’s overseas IT worker scheme collect nearly $800 million in wages paid by U.S. employers during 2024."},{"source_index":0,"quote":"The First Financial and Technical Development Center (FFTDC), designated on Wednesday, has equipped its workers with what Treasury officially calls “Super Intelligence (SI)” tools—AI systems used to evade hiring controls—along with deepfake video and real-time voice-manipulation capabilities documented by independent researchers."},{"source_index":0,"quote":"It is the first time the Office of Foreign Assets Control (OFAC) has specifically designated Russian nationals for laundering proceeds from North Korean IT workers, significantly expanding pressure into a geographic corridor that earlier rounds, focused on China, Vietnam and Laos, had largely left untouched."}],"impact.severity":[{"source_index":0,"quote":"The U.S. Treasury Department on Wednesday sanctioned 11 people and entities that helped North Korea’s overseas IT worker scheme collect nearly $800 million in wages paid by U.S. employers during 2024."}],"impact.severity_because":[{"source_index":0,"quote":"The U.S. Treasury Department on Wednesday sanctioned 11 people and entities that helped North Korea’s overseas IT worker scheme collect nearly $800 million in wages paid by U.S. employers during 2024."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-29"}]},"notes_on_gaps":"No source states when the AI-assisted hiring evasion occurred, who first noticed it, the model version, harness, tools granted, permissions scope, autonomy level, guardrails present, lifecycle stage, safeguard state, production intent, failure class, trigger, detection method, root cause, input provenance, operations paused, remediation, precursor events, direct loss figure, records exposed, third-party count, reversibility, industry, org size, denominator, systemic exposure, shared model id, upstream incident id, or evidence integrity. event.incident_class is 'other' because the AI tools were used by human operators to commit hiring and identity fraud; no value's test (hallucination, harmful_output, security_compromise, etc.) is met by the cited sentences. event.agent_involved is false because the cited sentences describe humans using AI-generated content, not an autonomous agent acting. event.date_disclosed is derived by rule and not written. system.developer is 'unknown' because no source names the organization that trained the SI tools. context.country is 'KP' based on the FFTDC/Pyongyang attribution. impact.severity is major because a regulator (Treasury/OFAC) is involved and many U.S. employers were affected; the $800 million figure is scheme-wide wages, not a stated direct loss to a single deployer, so the dollar bands are not applied as a point loss. system.tier: not set; no operator named and deployment_context is not a lab's. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-29] system.model_name: classified from described behaviour. system.integration_type: a source states the system produced content, or carried out an action, that it should have refused. system.developer: no source names the developer. system.deployment_context: classified from described behaviour. system.autonomy_level: no source states the arrangement. event.agent_involved: classified from described behaviour. event.incident_class: a concrete incident that meets no value's test; notes_on_gaps says why. event.trigger: no source states a cause. event.detection_method: no source says who first noticed. context.denominator_available: no denominator is available for this incident."},"context":{"industry":null,"org_size_band":null,"country":"KP","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":{"regimes":["OFAC sanctions under Executive Orders 13687 and 13722","U.S. sanctions strict liability","OFAC voluntary-disclosure program"],"notifications":null,"litigation_status":"unknown","safety_policy_adherence":null},"coverage":null},"narrative":{"steps":[{"step":"doing","text":"North Korea's FFTDC equipped overseas IT workers with 'Super Intelligence' AI tools, deepfake video and voice manipulation to apply for remote technical jobs at U.S. companies, evading hiring filters and identity checks.","quote":"The First Financial and Technical Development Center (FFTDC), designated on Wednesday, has equipped its workers with what Treasury officially calls “Super Intelligence (SI)” tools—AI systems used to evade hiring controls—along with deepfake video and real-time voice-manipulation capabilities documented by independent researchers.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Workers used AI-generated résumés, deepfake video and voice manipulation to pass hiring screens under false identities, breaching U.S. sanctions and employer identity-verification controls.","quote":"AI generates résumés tailored to applicant tracking system (ATS) algorithms, treating the ATS as an adversarial puzzle to be solved rather than a screening process to be answered honestly.","source_index":0,"grade":"C"},{"step":"reached","text":"The scheme reached U.S. technology companies, government contractors and financial services firms, collecting nearly $800 million in wages in 2024.","quote":"Workers have passed technical hiring screens at legitimate U.S. technology companies, government contractors and financial services firms.","source_index":0,"grade":"C"},{"step":"done","text":"Treasury sanctioned 11 people and entities, including Russian nationals and the FFTDC; Australia and the EU also designated linked people. The article recommends in-person verification, hardware-binding controls and payroll audits.","quote":"The U.S. Treasury Department on Wednesday sanctioned 11 people and entities that helped North Korea’s overseas IT worker scheme collect nearly $800 million in wages paid by U.S. employers during 2024.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-29","source_urls":["https://mx.ibtimes.com/north-korea-ai-hiring-fraud-sanctions-3482"]}}