U.S. Treasury Sanctions North Korean IT Worker Network Accused of Defrauding American Businesses

The U.S. Treasury Department sanctioned 10 people and a North Korean-controlled organization on Wednesday, accusing them of helping operate overseas IT worker schemes that deceive American businesses and channel earnings toward North Korea’s weapons programs.

The October 28 action reaches beyond the individuals seeking remote jobs under false identities. It also targets people accused of supervising those workers and moving their proceeds through cryptocurrency and other payment channels, including intermediaries operating in Russia.

In its announcement of the sanctions, Treasury said North Korean operatives use fabricated professional profiles, stolen identities and false documents to obtain work from legitimate employers. The government of North Korea then takes much of the income, according to the department, which says the broader schemes produce hundreds of millions of dollars for its weapons of mass destruction and ballistic missile programs.

The allegations also point to a security problem for employers. A worker hired to write software or maintain systems can potentially reach proprietary code and sensitive company information. Treasury described malware deployment, data theft and extortion as risks associated with these operations, though it did not identify a particular American company compromised by the newly designated people.

Russia-based facilitators handled millions in payments

One target, Russian national Vitold Viktorovich Obertas, allegedly provided financial services for North Korean officials and Amnokgang Technology Development Company, an organization sanctioned earlier this year. Treasury said Obertas conducted nearly $2 million in cryptocurrency conversions since January 2025, along with at least $1.25 million in other currency activity.

Another Russian national, Ilya Aleksandrovich Boykov, was accused of supporting Limited Liability Company Alis, an already sanctioned organization connected to North Korean IT workers. Since 2024, Boykov has exchanged or converted cryptocurrency worth the equivalent of $3.5 million and helped monitor payments and provide logistical support, according to Treasury.

Two North Korean nationals overseeing separate Russia-based groups were named as well. Kim Ki Hyok, whom Treasury described as supervising an Alis delegation and its financial targets, has transferred cryptocurrency valued at nearly $500,000 since 2024. Kim Hyo Dong allegedly helped another delegation affiliated with Chinyong Information Technology Cooperation Company evade sanctions and move more than $100,000 in financial assets since at least December 2023.

Those figures describe different activities over different periods. Some refer to money converted, while others concern assets transferred; they should not be added together as a total fraud loss or a measure of the money collected from U.S. employers. Treasury did not give a single consolidated amount for the network covered by Wednesday’s action.

The only organization newly sanctioned in the North Korea portion of the action was the First Financial and Technical Development Center, or FFTDC. Treasury identified it as a North Korean-controlled operation located in Russia that uses deployed IT personnel to earn money for Pyongyang. The department described FFTDC as operating in Russia since at least 2024 and said its workers have generated several million dollars.

Six North Korean workers based in Russia were also designated for supporting FFTDC. Treasury attributed more than $750,000 in collective revenue to those six since 2025. Their inclusion brings the day’s North Korea-related designations to 10 individuals and one entity, as reflected in the Office of Foreign Assets Control’s sanctions-list update.

Fraudulent hiring can turn into a data-security threat

The underlying method starts with employment rather than an obvious attempt to breach a company’s systems. North Korean workers can present themselves as applicants from other countries, use someone else’s identity or obtain projects through intermediaries. An employer may believe it is paying a legitimate remote developer without knowing the worker’s real identity, location or who ultimately receives the wages.

The danger does not necessarily end when the worker is discovered. In a January 2025 public warning, the FBI said some North Korean IT workers had copied company code repositories to personal accounts, taken sensitive data and attempted to extort victim businesses by threatening to disclose proprietary information. The bureau also described attempts to obtain account credentials and session information that could enable further unauthorized access.

These are warnings about a broader pattern, not findings that each person sanctioned Wednesday carried out every form of misconduct. Treasury’s latest action primarily identifies the people and organization it says helped sustain the worker operations and move the resulting funds.

For businesses, that distinction matters. A weak hiring check can create a payroll problem even without a detected security breach, because payments may be diverted to a prohibited network. Once a fraudulent worker obtains access to development tools or internal systems, the potential exposure expands to intellectual property and customer or corporate data.

The FBI advises employers to verify remote workers’ identities during interviews and onboarding, and to repeat those checks when appropriate. Its guidance also recommends reviewing unusual remote-access activity, limiting administrative privileges and watching for sensitive files being copied to personal cloud accounts or external code repositories. The bureau specifically warns that face-swapping and other artificial intelligence tools have been used to disguise applicants during video interviews.

Sanctions restrict access to U.S. assets and payments

Being added to Treasury’s sanctions list generally means any property or property interests belonging to the designated person that are in the United States, or held or controlled by a U.S. person, must be blocked and reported to OFAC. U.S. persons generally cannot deal in the property or interests of those designated unless an authorization or exemption applies.

The restrictions extend to businesses owned 50% or more, directly or indirectly and individually or in the aggregate, by one or more blocked people. OFAC also warned that sanctions violations can carry civil or criminal penalties, and civil enforcement may apply on a strict-liability basis. A sanctions designation is not itself a criminal conviction, and the Treasury announcement did not say the newly listed individuals had been convicted of the alleged conduct.

Wednesday’s measures build on earlier attempts to disrupt both the employment schemes and the financial infrastructure behind them. In March, Treasury sanctioned six individuals and two entities in a separate North Korean IT worker operation, including Amnokgang. The department said in that earlier announcement that the broader schemes generated nearly $800 million in 2024, indicating that the concern is not limited to a handful of questionable hiring arrangements.

The latest designations concentrate on Russia-based facilitators and personnel, but Treasury described the problem as international. It noted related action this month by Australia and the European Union against people and organizations supporting North Korean revenue generation and military activities. The department has not supplied an estimate of how much future income Wednesday’s sanctions will prevent.

For employers that suspect an applicant or contractor has used a fraudulent identity, the FBI recommends examining the person’s assigned device and network activity, using intrusion-detection tools and reporting suspected incidents promptly through its Internet Crime Complaint Center. Those steps address the immediate exposure that sanctions against overseas intermediaries cannot resolve on their own.