U.S. Treasury Sanctions 10 Individuals and One Entity in North Korean IT Worker Scheme

Key Facts

The U.S. Treasury Department’s Office of Foreign Assets Control on October 28 designated 10 individuals and one entity over information technology worker schemes run by the North Korean government, saying the network defrauded U.S. companies and generated revenue for weapons and missile programs. The action targets both workers who obtain jobs using concealed identities and intermediaries who help transfer the money, according to a Treasury statement. The department said the workers used fraudulent documents, stolen identities and fabricated personas to work at legitimate companies. It added that the regime takes most of their wages. Treasury said some workers exploited their access to corporate networks to deploy malware, extract sensitive data and steal proprietary information.

Treasury said Russian intermediary Vitold Viktorovich Obertas had transferred nearly 2 million dollars in cryptocurrency to North Korean officials since January 2025, alongside transactions in other currencies totaling at least 1.25 million dollars over the same period. The figures distinguish between two financial channels, one involving cryptocurrency and the other involving different currencies, according to the statement. The department also said Russian national Ilya Aleksandrovich Boykov had supported Alice Company since 2024 by exchanging and transferring cryptocurrency transactions equivalent to 3.5 million dollars. His role included monitoring transactions and providing logistical support, Treasury said. The department said the networks used cryptocurrency transactions, money-laundering methods and emerging technologies, including artificial intelligence tools, to generate millions of dollars and transfer them for the benefit of the North Korean government.

The sanctions include the First Financial and Technical Development Center, an entity controlled by North Korea, according to Treasury. The department said the center’s IT workers used Super Intelligence tools and sophisticated money-laundering methods. In a separate case linked to the worker schemes, the U.S. Department of Justice said facilitators in the United States hosted victim companies’ laptops in their homes, in arrangements it called “laptop farms.” The arrangements were intended to make it appear that remote workers were located in the United States. The Justice Department said a separate indictment was returned on October 1, 2026, following a yearlong investigation, and included charges of conspiracy to commit wire fraud, money laundering and identity theft.

Reuters reported that the case announced by the Justice Department in October affected more than 70 U.S. companies, involved the compromise of 25 Americans’ identities and generated at least 3 million dollars for workers overseas. In separate operations in Texas, federal authorities searched more than 40 homes between September 21 and 25 as part of a campaign against sites suspected of being “laptop farms,” seizing about 187 laptops and other devices, Reuters reported. U.S. Attorney David Toepfer said the charges were “an urgent warning to all American companies to exercise caution in their hiring practices.” The case places remote hiring among the risks facing companies, alongside the network and data security risks cited by Treasury. Treasury also said cryptocurrency transactions and money-laundering methods were used to generate and move funds.

The sanctions freeze the property and interests in property of the designated individuals and entity that are in the United States or in the possession or control of U.S. persons, and generally prohibit transactions involving them, according to the Treasury statement. The restrictions also apply to entities owned 50% or more, directly or indirectly, individually or collectively, by blocked persons. The department said the action builds on the designation of a separate North Korean IT worker network on March 12, 2026. It added that Australia and the European Union designated individuals and entities supporting North Korea’s revenue generation and military activities during October. Treasury said the earlier designation targeted another network, while the new action broadens the targeting of individuals and entities linked to the schemes.