The U.S. Treasury Department has imposed new economic sanctions targeting a North Korean government-run scheme that utilizes fraudulent identities to place overseas information technology workers inside legitimate companies in the United States and allied nations. According to federal officials, the operation funnels earnings directly toward Pyongyang’s weapons of mass destruction and ballistic missile programs.
The Office of Foreign Assets Control designated 10 individuals and one entity accused of helping operate or finance the illicit network. Treasury officials stated that the North Korean workers employed stolen identities, fraudulent documents, and fake personas to secure remote or on-site technology jobs.
“The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments,” Treasury Secretary Scott Bessent said in a statement. “Under President Trump’s leadership, Treasury will continue to use all available tools to protect U.S. businesses from these malicious activities and hold those responsible accountable.”
Once employed by legitimate businesses, the operatives allegedly surrendered the majority of their wages to the regime. The Treasury Department estimates that the scheme has generated hundreds of millions of dollars to support North Korea’s military ambitions. Beyond wage extraction, the networks have deployed malware, stolen sensitive data and proprietary information, and extorted businesses worldwide.
Investigators found that the operatives relied on advanced technology, including cryptocurrency, sophisticated money-laundering techniques, and artificial intelligence tools, to generate and transfer funds for the North Korean government.
Among those designated by OFAC are two Russian intermediaries. Vitold Viktorovich Obertas allegedly handled nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions for North Korean officials beginning in January 2025. Another Russian national, Ilya Aleksandrovich Boykov, allegedly supported a previously sanctioned North Korean entity by facilitating cryptocurrency transactions equivalent to $3.5 million since 2024.
Also targeted is the First Financial and Technical Development Center, a North Korean-controlled entity operating in Russia. According to the Treasury, this center deployed highly trained IT workers who utilized specialized intelligence tools and complex money-laundering methods, including intricate cryptocurrency transfers.
The latest penalties follow a separate round of Treasury sanctions imposed against another North Korean IT worker network in March. The new designations freeze all property and interests in property belonging to the sanctioned individuals and entity that are located within the United States or controlled by U.S. persons. Furthermore, the measures generally prohibit U.S. persons from engaging in financial transactions with the designated parties unless authorized by OFAC.
