US Sanctions 10 Individuals and Entity Over North Korean IT Fraud Networks

ERBIL (Kurdistan24) — The United States has sanctioned 10 individuals and one entity accused of facilitating North Korean government-run information technology (IT) worker schemes that defraud American businesses and generate revenue for Pyongyang’s weapons programs, the US Department of the Treasury announced on Wednesday.

The Treasury’s Office of Foreign Assets Control (OFAC) said the networks use stolen identities, fraudulent documents, and fabricated personas to secure employment with legitimate companies, including in the United States and allied countries.

The North Korean government subsequently appropriates most of the workers’ wages to finance its unlawful weapons of mass destruction (WMD) and ballistic missile programs.

“The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments,” Treasury Secretary Scott Bessent said in a statement.

Bessent added that, under President Donald Trump’s leadership, the Treasury would continue using available tools to protect US businesses and hold those responsible accountable.

The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments. Under President Trump’s leadership, Treasury will continue to use all available tools to protect U.S. businesses from these malicious activities and hold those responsible accountable.

— Treasury Secretary Scott Bessent (@SecScottBessent) October 28, 2026

According to the Treasury, North Korea’s IT worker schemes generate hundreds of millions of dollars for the government, while associated financial networks use cryptocurrency transactions, money laundering techniques, and artificial intelligence tools to move illicit proceeds across international financial systems.

Beyond generating revenue, the workers have allegedly exploited their access to corporate networks to deploy malware, extract sensitive data, and steal proprietary information, exposing businesses worldwide to cybersecurity and financial risks.

Russia-based networks targeted

The latest sanctions target facilitators and IT workers operating in North Korea and Russia, including individuals accused of managing overseas delegations, converting cryptocurrency, transferring financial assets, and providing logistical support to the networks.

Among those sanctioned is Russian national Vitold Viktorovich Obertas, whom OFAC accused of facilitating illicit financial transactions for North Korean officials. Since January 2025, Obertas has conducted nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions on their behalf, according to the Treasury.

OFAC also targeted Kim Ki Hyok, who leads a Russia-based delegation of North Korean IT workers associated with Limited Liability Company Alis, and Kim Hyo Dong, who leads a separate delegation linked to Chinyong Information Technology Cooperation Company.

The Treasury said the two individuals facilitated cryptocurrency transfers, logistical operations, and sanctions evasion.

Russian national Ilya Aleksandrovich Boykov was also designated for allegedly supporting Alis through cryptocurrency exchanges and conversions equivalent to $3.5 million since 2024, alongside transaction monitoring and logistical assistance.

The sanctions further target the First Financial and Technical Development Center (FFTDC), a North Korean-controlled entity based in Russia that deploys IT workers to generate revenue for Pyongyang.

According to OFAC, six North Korean nationals working in Russia — Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan, and Hyon Se Il — collectively generated more than $750,000 for the entity since 2025.

The Treasury said the workers used sophisticated money laundering methods, including complex cryptocurrency transfers, and artificial intelligence-related tools to support their operations.

International effort to disrupt illicit financing

The latest action builds on OFAC’s March 12, 2026, designation of a separate North Korean IT worker network, as Washington seeks to disrupt the financial infrastructure supporting Pyongyang’s weapons development.

The Treasury said Australia and the European Union had also designated individuals and entities linked to North Korea’s revenue-generating and military activities during October.

Washington is coordinating with international partners, including participating states of the Multilateral Sanctions Monitoring Team, to expose and disrupt networks accused of helping Pyongyang evade sanctions.

The department said the global reach of these financial networks requires a coordinated international response to prevent illicit proceeds from moving through the international financial system.

Financial restrictions and legal consequences

Under the sanctions, all property and interests in property belonging to the designated individuals and entity that are located in the United States or held or controlled by US persons are blocked and must be reported to OFAC.

Entities owned, directly or indirectly, at least 50 percent by one or more blocked persons are also subject to the restrictions. Unless an exemption or authorization applies, US persons and transactions within or transiting the United States are generally prohibited from dealing with blocked property.

The Treasury warned that violations could result in civil or criminal penalties for US and foreign persons. Non-US individuals and entities may also face penalties for causing violations of US sanctions or engaging in activities intended to evade them.

North Korea has long faced international sanctions over its nuclear and ballistic missile programs. Washington’s latest measures seek to cut off financial channels that US authorities say allow Pyongyang to exploit overseas employment and digital technologies to fund those activities.