The Treasury Department sanctioned 10 North Koreans and Russians and a North Korea-controlled centre based in Russia on Wednesday, striking at a state-run scheme that plants North Korean computer specialists inside real companies — including American ones — under false identities, then funnels their pay back to Pyongyang's weapons programs.
The Office of Foreign Assets Control (OFAC) designated eight North Korean nationals, two Russian nationals and the First Financial and Technical Development Center, an entity the Treasury says is controlled by North Korea and located in Russia. The 10 were designated under two executive orders for running, financing or working in what the department calls government-run information technology worker schemes — operations that "defraud U.S. businesses and generate revenue for the DPRK's unlawful weapons of mass destruction (WMD) and ballistic missile programs."
"The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments," said Secretary of the Treasury Scott Bessent. "Under President Trump's leadership, Treasury will continue to use all available tools to protect U.S. businesses from these malicious activities and hold those responsible accountable."
The scheme works through ordinary hiring. North Korea "continues to rely on fraudulent documents, stolen identities, and fabricated personas to conceal its IT workers and secure employment with legitimate companies, including those in the United States and allied countries," the Treasury said. The worker takes a remote technology job — writing code, maintaining systems, doing the work of any other contractor — while hiding who he really is and where he really sits. "The DPRK regime then appropriates most of these workers' wages," the department said, money that adds up across the whole programme to "hundreds of millions of dollars to fund its unlawful WMD and ballistic missile programs."
The danger to the hiring company does not end with the payroll. Once inside, some of the workers "have exploited their access to corporate networks to deploy malware, exfiltrate sensitive data, and steal proprietary information, creating significant risks for businesses worldwide," the Treasury said. The networks behind them "have leveraged sophisticated cryptocurrency transactions, money laundering techniques, and emerging technologies, including artificial intelligence tools, to generate and transfer millions of dollars for the DPRK government." The Russia-based centre's workers, the department said, employ what it called Super Intelligence tools alongside complex cryptocurrency transfers to move their earnings.
The centre at the heart of Wednesday's action, the First Financial and Technical Development Center, has deployed highly trained North Korean IT workers to Russia and, on the Treasury's account, has generated several million dollars for the government in Pyongyang. Six of its Russia-based workers were named individually — Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan and Hyon Se Il — and together they are said to have generated more than $750,000 for the centre since 2025.
Alongside the workers, the Treasury went after the men who move the money. Russian intermediary Vitold Viktorovich Obertas has, since January 2025, conducted nearly $2 million worth of cryptocurrency conversions and at least $1.25 million in other currency transactions for North Korean officials, including for the previously sanctioned Amnokgang Technology Development Company. Another Russian, Ilya Aleksandrovich Boykov, has since 2024 converted the equivalent of $3.5 million in cryptocurrency in support of a North Korean company called Alis. The delegation bosses were named too: Kim Ki Hyok, who leads Alis's Russia-based team, watches the workers and makes sure they hit their financial targets, and has transferred nearly $500,000 in cryptocurrency since 2024; Kim Hyo Dong, who runs a second delegation, has moved more than $100,000.
Designation puts all 10 and the centre on the U.S. sanctions blacklist. Any property they hold in the United States, or in the hands of Americans, is blocked and must be reported to OFAC; any company owned 50 percent or more by a blocked person is blocked as well. Americans are generally barred from any dealing with them, and violations can draw civil or criminal penalties — civil penalties, the Treasury notes, can be imposed on a strict liability basis, which means a breach can be punished even where the person involved did not know.
Wednesday's action is the latest cut in a campaign, not a one-off. It builds on OFAC's March 12 designation of a separate North Korean IT worker network, and on earlier designations that hit the Chinyong Information Technology Cooperation Company in 2023, its subordinate Alis in 2024, and Amnokgang this past March. The United States is not moving alone: Australia and the European Union also designated people and entities supporting North Korea's revenue generation this month, and the Treasury says it acts in close partnership with the Multilateral Sanctions Monitoring Team states and other partners to, in its words, "expose and disrupt those enabling the DPRK to evade sanctions and finance its unlawful weapons programs."
The sanctions land in the middle of a frozen diplomacy. President Trump has spoken of restarting talks with North Korea, but Pyongyang has shown little interest in negotiations aimed at containing its nuclear program, and the president recently downplayed the idea of another high-profile meeting with Kim Jong Un. North Korea's mission to the United Nations in New York did not immediately respond to the announcement.
For American employers, the warning inside Wednesday's action is practical. A remote hire who arrives with stolen documents and a fabricated persona is not just a fraud on the payroll: on the Treasury's account, that same access can be turned to stealing a company's data and holding it for ransom. That is why the department points businesses to the standing advisories on North Korean IT workers issued by the Departments of State, Treasury and Justice and by the FBI, which set out the tactics these operatives use and the steps companies can take to protect their networks. The sanctions themselves are aimed at the network — the workers, their delegation leaders and the men converting their wages — and at cutting off a revenue stream the Treasury says feeds weapons of mass destruction and ballistic missiles. Every salary intercepted on its way to Pyongyang is money that does not reach those programs.
The designations took effect immediately. The Treasury's stated goal, as in every such action, "is not to punish, but to bring about a positive change in behavior" — and its promise, in the secretary's words, is to keep using "all available tools" until the networks that turn American jobs into weapons money are dismantled.
📣 Join ProfiloPolitics on Telegram — breaking news first
Follow @profilopoliticsnews for every update on this story.