OFAC Sanctions DPRK IT Worker Network Facilitators and Russian Crypto Intermediaries
Summary
OFAC sanctioned 10 individuals and one entity over DPRK IT-worker schemes that place operatives in businesses and route earnings through cryptocurrency. Chainalysis describes Russian intermediaries and AI-enabled hiring deception.
Key points
- OFAC sanctioned 10 individuals and one entity for supporting DPRK government-run IT-worker schemes that generate revenue for the regime.
- OFAC says Russian national Obertas converted nearly $2 million in cryptocurrency for DPRK officials; Chainalysis says its research traces his network ties to 2023.
- Chainalysis describes a worker wallet receiving stablecoins, converting them to ETH, and sending funds through consolidation addresses to Boykov, who sent cryptocurrency to Garantex for cashout.
- Russia-based FFTDC and six DPRK IT workers were sanctioned; the workers reportedly generated more than $750,000 for FFTDC since 2025.
- Chainalysis reports DPRK operatives use generative AI for tailored resumes and cover letters, and in some cases AI-generated profile photos and deepfake interview video.
- The article recommends screening designated people, entities, and cryptocurrency addresses and investigating suspicious transactions and overseas IT-worker activity.
Article Details
- Event Type
- OFAC sanctions against individuals and an entity involved in DPRK IT worker fraud and financial facilitation.
- Impact
- OFAC sanctioned 10 individuals and one entity for supporting North Korean government-run IT worker schemes targeting U.S. businesses and generating revenue for the DPRK. The article reports that cryptocurrency conversions and other financial transactions helped move proceeds to DPRK officials and support weapons programs. Six Russia-based workers collectively generated more than $750,000 for FFTDC since 2025.
Threat Actors
Han Yu SongOFAC sanctioned Han Yu Song as one of six Russia-based DPRK IT workers who collectively generated more than $750,000 for FFTDC since 2025.Hyon Se IlOFAC sanctioned Hyon Se Il as one of six Russia-based DPRK IT workers who collectively generated more than $750,000 for FFTDC since 2025.Ilya Aleksandrovich BoykovOFAC sanctioned Boykov for supporting Alis through cryptocurrency transactions, monitoring, and logistical assistance. The article reports that he converted cryptocurrency for DPRK-linked front companies and sent funds to Garantex for cashout.Kim Hyo DongOFAC sanctioned Kim Hyo Dong for leading a Chinyong-subordinate IT worker delegation, providing logistical assistance, engaging in sanctions evasion, and facilitating more than $100,000 in financial assets.Kim Ki HyokOFAC sanctioned Kim Ki Hyok for leading an Alis IT worker delegation; the article says he transferred nearly $500,000 in cryptocurrency for the group.Kim Kyong JuOFAC sanctioned Kim Kyong Ju as one of six Russia-based DPRK IT workers who collectively generated more than $750,000 for FFTDC since 2025.Kim Sung GwanOFAC sanctioned Kim Sung Gwan as one of six Russia-based DPRK IT workers who collectively generated more than $750,000 for FFTDC since 2025.Ri Thae CholOFAC sanctioned Ri Thae Chol as one of six Russia-based DPRK IT workers who collectively generated more than $750,000 for FFTDC since 2025.So Hyon JinOFAC sanctioned So Hyon Jin as one of six Russia-based DPRK IT workers who collectively generated more than $750,000 for FFTDC since 2025.Vitold Viktorovich ObertasOFAC sanctioned Obertas for serving as an intermediary in illicit DPRK financial transactions. According to OFAC as reported in the article, he converted nearly $2 million in cryptocurrency into fiat for DPRK officials and conducted at least $1.25 million in other currency transactions since January 2025.
Vendors
Products
Countries
North KoreaDevelopment Center (FFTDC), which has deployed IT workers who generate millions of dollars for North Korea. FFTDC was sanctioned today.RussiaDPRK nationals Kim Ki Hyok and Kim Hyo Dong managed groups of IT workers based in Russia, monitoring their work at victim companies and collecting the cryptocurrency income they generated.United StatesOFAC sanctioned Russian and DPRK nationals that targeted U.S.