Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses
WASHINGTON—Today, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned 10 individuals and one entity for their roles in Democratic People’s Republic of Korea (DPRK) government-run information technology (IT) worker schemes that defraud U.S. businesses and generate revenue for the DPRK’s unlawful weapons of mass destruction (WMD) and ballistic missile programs.
“The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments,” said Secretary of the Treasury Scott Bessent. “Under President Trump’s leadership, Treasury will continue to use all available tools to protect U.S. businesses from these malicious activities and hold those responsible accountable.”
The DPRK continues to rely on fraudulent documents, stolen identities, and fabricated personas to conceal its IT workers and secure employment with legitimate companies, including those in the United States and allied countries. The DPRK regime then appropriates most of these workers’ wages, generating hundreds of millions of dollars to fund its unlawful WMD and ballistic missile programs. Today’s action targets key facilitators and financial networks that help sustain these schemes and move illicit proceeds on behalf of the DPRK. These networks have leveraged sophisticated cryptocurrency transactions, money laundering techniques, and emerging technologies, including artificial intelligence tools, to generate and transfer millions of dollars for the DPRK government. In addition to generating revenue, DPRK IT workers have exploited their access to corporate networks to deploy malware, exfiltrate sensitive data, and steal proprietary information, creating significant risks for businesses worldwide.
Today’s action builds on OFAC’s March 12, 2026 designation of a separate DPRK IT worker network and demonstrates Treasury’s sustained commitment to dismantling the networks that generate illicit revenue for the DPRK. These networks permeate through the global financial system, necessitating a unified response to match the threat. The United States is joined this month by Australia and the European Union in designating individuals and entities supporting the DPRK’s revenue generation and military activities. Treasury continues to take these actions in close partnership with the Multilateral Sanctions Monitoring Team (MSMT) Participating States and other international partners. Working with allies and partners, the United States will continue to expose and disrupt those enabling the DPRK to evade sanctions and finance its unlawful weapons programs.
More information about the tactics utilized by DPRK IT workers and steps that can be taken to protect private networks can be found in advisories and alerts regarding DPRK IT workers issued by the Departments of State, Treasury, and Justice; the FBI; and a multilateral consortium of law enforcement.
KEY ENABLERS OF GLOBAL DPRK IT WORKER NETWORKS
OFAC’s action today targets several DPRK IT worker networks by designating facilitators and DPRK IT workers based in the DPRK and Russia.
Vitold Viktorovich Obertas (Obertas) is a Russian intermediary for illicit DPRK financial transactions, including for Amnokgang Technology Development Company (Amnokgang). OFAC designated Amnokgang in its March 12, 2026 action. Since January 2025, Obertas has conducted nearly $2 million worth of cryptocurrency conversions, as well as at least $1.25 million in other currency transactions, for DPRK officials. OFAC is designating Obertas pursuant to Executive Order (E.O.) 13687 for having materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of, the Government of North Korea.
DPRK-national Limited Liability Company Alis (Alis) lead Kim Ki Hyok leads a Russia-based delegation of DPRK IT workers, whose primary duties include monitoring Alis IT workers and ensuring they meet their financial targets. OFAC designated Alis in March 2024 for being subordinate to the Chinyong Information Technology Cooperation Company (Chinyong), which OFAC designated in May 2023. Since 2024, Kim Ki Hyok has transferred cryptocurrency for the delegation valued at nearly $500,000. Additionally, DPRK national Kim Hyo Dong leads a separate Russia-based Chinyong-subordinate delegation. Since at least December 2023 Kim Hyo Dong has provided logistical assistance to the IT worker delegation, engaged in sanctions evasion efforts, and facilitated the transfer of over $100,000 equivalent in financial assets. OFAC is designating Kim Ki Hyok and Kim Hyo Dong pursuant to E.O. 13687 for having materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of, Chinyong.
Since 2024, Russian national Ilya Aleksandrovich Boykov (Boykov) has actively supported Alis by exchanging and converting an equivalent of $3.5 million in cryptocurrency transactions, monitoring cryptocurrency transactions, and providing logistical support for Alis. OFAC is designating Boykov pursuant to E.O. 13687 for having materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of, Alis.
Since at least 2024, the **First Financial and Technical Development Center (**FFTDC) is a DPRK-controlled entity located in Russia that uses DPRK IT workers who have generated several millions of dollars on behalf of the DPRK government. The FFTDC has deployed several highly trained DPRK IT workers to Russia who employ Super Intelligence (SI) tools and use sophisticated money laundering methods, including complex cryptocurrency transfers, to facilitate their revenue generation schemes. Since 2025, Russia-based DPRK IT workers Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan, and Hyon Se Il have collectively generated over $750,000 on behalf of the FFTDC.
OFAC is designating FFTDC pursuant to E.O. 13722 for having engaged in, facilitated, or been responsible for the exportation of workers from North Korea, including exportation to generate revenue for the Government of North Korea or the Workers’ Party of Korea. Additionally, OFAC is designating Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan, and Hyon Se Il pursuant to E.O. 13722 for having materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of, FFTDC.
SANCTIONS IMPLICATIONS
As a result of today’s action, all property and interests in property of the designated or blocked persons described above that are in the United States or in the possession or control of U.S. persons are blocked and must be reported to OFAC. In addition, any entities that are owned, directly or indirectly, individually or in the aggregate, 50 percent or more by one or more blocked persons are also blocked. Unless authorized by a general or specific license issued by OFAC, or exempt, OFAC’s regulations generally prohibit all transactions by U.S. persons or within (or transiting) the United States that involve any property or interests in property of blocked persons.
Violations of U.S. sanctions may result in the imposition of civil or criminal penalties on U.S. and foreign persons. Non-U.S. persons are also prohibited from causing or conspiring to cause U.S. persons to wittingly or unwittingly violate U.S. sanctions, as well as engaging in conduct that evades U.S. sanctions. OFAC may impose civil penalties for sanctions violations on a strict liability basis. OFAC’s Economic Sanctions Enforcement Guidelines provide more information regarding OFAC’s enforcement of U.S. economic sanctions. In addition, financial institutions and other persons may risk exposure to sanctions for engaging in certain transactions or activities involving designated or otherwise blocked persons. The prohibitions include the making of any contribution or provision of funds, goods, or services by, to, or for the benefit of any designated or blocked person, or the receipt of any contribution or provision of funds, goods, or services from any such person.
The power and integrity of OFAC sanctions derive not only from OFAC’s ability to designate and add persons to the Specially Designated Nationals and Blocked Persons List (SDN List), but also from its willingness to remove persons from the SDN List consistent with the law. The ultimate goal of sanctions is not to punish, but to bring about a positive change in behavior. For information concerning the process for seeking removal from an OFAC list, including the SDN List, or to submit a request, please refer to OFAC’s guidance on Filing a Petition for Removal from an OFAC List.
Click here for more information on the persons designated today.
###
Legal Disclaimer:
EIN Presswire provides this news content "as is" without warranty of any kind. We do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the author above.
