US sanctions North Korean IT worker network accused of defrauding businesses
The Treasury says the network placed IT workers in companies and sent much of their pay to North Korea. The new designations include a Russia-based entity and people linked to it.
The United States imposed sanctions on October 28 against a North Korean IT worker network accused of obtaining jobs at businesses in the US and elsewhere to raise money for Pyongyang’s weapons programs, according to Reuters. The action targets workers and facilitators in North Korea and Russia, extending US restrictions to people and an organisation the Treasury links to the alleged scheme.
The Treasury says the workers fraudulently secure employment and that the North Korean government takes most of their wages to fund weapons of mass destruction and ballistic missile programs, Reuters reported. North Korea’s mission to the United Nations in New York had not responded to Reuters’ request for comment at the time of its report.
Who the October 28 sanctions target
Reuters identified the First Financial and Technical Development Center as the targeted entity and said six sanctioned individuals are linked to it. CBS News reported that the sanctions cover 10 North Koreans and Russians in all, including Russian national Vitold Viktorovich Obertas and North Korean national Kim Ki Hyok. CBS described the center as North Korean-controlled and based in Russia, where it said the organisation recruits IT workers for jobs abroad and handles cryptocurrency transfers.
According to CBS, the Treasury says Obertas processed nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025. It says Kim leads an IT worker delegation in Russia, monitors its personnel and financial targets, and has transferred nearly $500,000 in cryptocurrency for the delegation since 2024. Those figures describe transactions attributed to the individuals, rather than an independently established total raised through the alleged employment scheme.
What the restrictions mean for US businesses
CBS reported that US-linked property and interests in property of those designated are blocked and that Americans and US residents are generally prohibited from dealing with them. CBS described an operation involving stolen identities and false résumés to obtain legitimate IT jobs. It reported that workers with access to corporate networks could also reach sensitive data, deploy malware or extort employers; those are risks associated with the scheme, not findings that every sanctioned person took those steps.
The Treasury sanctioned a separate North Korean IT worker network in March, Reuters reported. It said Australia and the European Union also imposed North Korea-related sanctions earlier in October. The latest US action therefore follows earlier measures against alleged worker networks, while the October 28 designations address the specific people and entity named in this announcement.
Read in depth: World
Netanyahu retains security powers as Israel enters caretaker period
After Israel’s 27 October election, Benjamin Netanyahu remains caretaker prime minister. Legal analysts say the government faces constraints on some decisions but retains...
Shehbaz Sharif sets November progress deadline for Pakistan-Alibaba digital projects
Pakistan’s prime minister told ministries to set targets and report progress on cooperation with Alibaba, spanning exports, agriculture, training and public services.
Sources and context
- US sanctions North Korean network accused of defrauding businessesReuters, carried by The Straits Times
- Treasury sanctions 10 North Koreans and Russians over IT worker fraud schemeCBS News
AI-assisted article checked against the listed sources. NewsJaws did not conduct interviews or attend the reported events.
Topics in this story
More from World
Illustration