Treasury Sanctions 10 Individuals and One Entity Facilitating DPRK IT Worker Fraud Targeting U.S. Businesses
The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) on October 28 sanctioned 10 individuals and one entity for their roles in North Korea's government-run information technology (IT) worker schemes, which use fraudulent documents, stolen identities, and fabricated personas to place workers inside legitimate companies in the United States and allied countries, with most wages appropriated by the regime to fund its weapons of mass destruction and ballistic missile programs.
"The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments," said Secretary of the Treasury Scott Bessent. "Under President Trump's leadership, Treasury will continue to use all available tools to protect U.S. businesses from these malicious activities and hold those responsible accountable."
Many of those designated operate from Russia. Russian intermediary Vitold Viktorovich Obertas has conducted nearly $2 million worth of cryptocurrency conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025. Russian national Ilya Aleksandrovich Boykov has supported the network with the equivalent of $3.5 million in cryptocurrency exchanges and conversions since 2024. North Korean national Kim Ki Hyok, who leads a Russia-based delegation of IT workers, has transferred cryptocurrency valued at nearly $500,000, while Kim Hyo Dong has facilitated the transfer of over $100,000 in financial assets.
The designated entity, the First Financial and Technical Development Center, is a North Korea-controlled organization based in Russia; six of its IT workers have collectively generated over $750,000 for the North Korean government since 2025. Treasury said the networks have used sophisticated cryptocurrency transactions, money laundering techniques, and super intelligence (SI) tools, and that DPRK IT workers have also exploited their access to corporate networks to deploy malware and steal sensitive data and proprietary information.
Treasury said the action builds on OFAC's March 12, 2026 designation of a separate DPRK IT worker network, and that Australia and the European Union are also designating related individuals and entities this month. As a result of the action, all property and interests in property of the designated persons in the United States or in the possession or control of U.S. persons are blocked and must be reported to OFAC, and U.S. persons are generally prohibited from transactions involving them.
Source: GSM · USA (original Chinese edition)
Photo: 图：位于华盛顿的美国财政部大楼航拍，G. Edward Johnson 摄。CC BY 4.0，经维基共享资源。 / Aerial view of the U.S. Department of the Treasury building in Washington, D.C., by G. Edward Johnson. CC BY 4.0, via Wikimedia Commons.
