Treasury Targets North Korean IT-Worker Fraud Network Inside U.S. Firms

Treasury Targets North Korean IT-Worker Fraud Network Inside U.S. Firms

10 people and one entity face sweeping U.S. sanctions

The U.S. Department of the Treasury's Office of Foreign Assets Control announced on Oct. 28 that it had sanctioned 10 individuals and one entity over roles in North Korean government-run IT worker schemes that defraud U.S. businesses and raise money for Pyongyang's weapons of mass destruction and ballistic missile programs. The designations cover eight North Korean nationals and two Russian nationals, plus the Russia-based First Financial and Technical Development Center, described as controlled by North Korea.

Stolen identities turned into paychecks for Pyongyang

According to Treasury, the workers hid their nationalities and used stolen identities, fraudulent documents and invented personas to win jobs at legitimate technology companies in the United States and allied countries. Once hired, most of their wages were funneled back to the North Korean state. CBS News and Fox Business report that the broader enterprise has generated hundreds of millions of dollars over time, making it a major funding stream for weapons programs.

Russia-based hub paired AI tools with crypto laundering

Treasury said the First Financial and Technical Development Center has operated from Russia since at least 2024, deploying highly trained North Korean IT workers who used so-called Super Intelligence tools and sophisticated laundering techniques, including complex cryptocurrency transfers. Six workers tied to the center generated more than $750,000, according to The Hill and AsiaToday. Treasury also accused Russian intermediary Vitold Viktorovich Obertas of processing nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025, while another Russian national was reported to have converted about $3.5 million in cryptocurrency.

Bessent accuses operatives of weaponizing stolen data

Treasury Secretary Scott Bessent said the North Korean regime keeps targeting and exploiting American companies through fraud by its overseas IT operatives, who weaponize sensitive data and extort businesses for large payments. Officials added that some workers deployed malware or threatened employers with stolen data. The sanctions block property and interests in property of the designated people and entity that are in the United States or held by U.S. persons, and generally bar Americans from dealings with them absent a license.

A repeat crackdown leaves employers with the vetting burden

The move follows a separate U.S. sanctions action against another North Korean IT-worker network in March, as noted by U.S. News. In July, the United States, Australia, Japan, South Korea, Britain, Canada and several European countries jointly warned that North Korean workers were using increasingly sophisticated methods, including AI, to hide their identities and expand globally. For U.S. employers, especially those hiring remote tech staff, the case sharpens the question of how far background checks and identity verification must go, and what comes next depends on whether enforcement and company screening can keep pace with the fraud.