Treasury Sanctions North Korean IT Fraud Network Operating in Russia

The US Treasury Department imposed sanctions Wednesday against 10 individuals and one entity accused of supporting a North Korean government operation that places fraudulent IT workers at legitimate businesses and channels their earnings toward Pyongyang's weapons programs. The action targets a network operating partly through Russia, according to the department.

The Treasury's Office of Foreign Assets Control (OFAC) designated individuals from North Korea and Russia, along with the Russia-based First Financial and Technical Development Center, which authorities say helped deploy North Korean technology workers and facilitate financial transfers.

According to the Treasury Department, operatives use stolen identities, falsified documents and fabricated professional profiles to secure technology jobs at companies in the United States and allied countries. The regime allegedly collects most of the workers' wages, generating hundreds of millions of dollars for weapons of mass destruction and ballistic missile programs.

The department also accused some workers of deploying malware, stealing sensitive data and proprietary information, and extorting employers. According to Treasury, the network has used cryptocurrency, sophisticated money-laundering methods and artificial intelligence tools to generate and move funds.

Treasury Secretary Scott Bessent said the operation exposes American businesses to financial and cybersecurity risks.

"The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments," Treasury Secretary Scott Bessent said.

Bessent said the administration would continue using financial enforcement measures to address the activity and hold those responsible accountable.

"Under President Trump’s leadership, Treasury will continue to use all available tools to protect U.S. businesses from these malicious activities and hold those responsible accountable," he continued.

Among the sanctioned individuals is Russian national Vitold Viktorovich Obertas, whom Treasury accused of processing financial transactions for North Korean officials. Since January 2025, he allegedly facilitated nearly $2 million in cryptocurrency conversions and at least $1.25 million in additional currency transactions.

Another Russian national, Ilya Aleksandrovich Boykov, allegedly facilitated cryptocurrency transactions worth the equivalent of $3.5 million since 2024 in support of a previously sanctioned North Korean entity, according to Treasury.

The sanctions also target North Korean national Kim Ki Hyok, who Treasury says leads an IT worker delegation in Russia, supervises personnel and ensures the group meets financial targets. Since 2024, he has transferred nearly $500,000 in cryptocurrency on behalf of the delegation, according to the department.

The First Financial and Technical Development Center allegedly recruits highly trained North Korean IT workers for jobs in the United States and other countries while coordinating cryptocurrency transfers. Treasury said the organization used sophisticated money-laundering techniques and artificial intelligence tools, including what it described as "Super Intelligence (SI) tools." Six operatives associated with the center were also sanctioned.

The designations block property and interests in property belonging to the listed individuals and entity when those assets are in the United States or under the possession or control of US persons. US persons are generally prohibited from conducting transactions involving the designated parties unless OFAC authorizes them.

The Treasury Department previously imposed separate sanctions against another North Korean IT worker network in March, as Washington continues targeting operations accused of converting fraudulent employment into revenue for Pyongyang's weapons programs.