The U.S. Treasury Department on Wednesday imposed new sanctions on an international fraud network that North Korea has been using to infiltrate American companies by posing as legitimate job seekers.
Officials say North Korean IT workers, operating under stolen or fabricated identities, have been hired by U.S. firms where they collect salaries, steal sensitive data, and in some cases demand ransom payments. The network is believed to have generated at least $1 million in profit for Pyongyang, helping fund its heavily sanctioned nuclear weapons program.
Related: Hackers Breach North Korean Cyber Operative, Leak Rare Inside Look at Kimsuky Group
Among those targeted in the latest enforcement round is Vitaliy Sergeyevich Andreyev, a Russian national accused of helping North Korean operatives launder money. The Treasury says Andreyev worked with a North Korean consular official in Russia, Kim Ung Sun, to move nearly $600,000 in stolen funds into cryptocurrency.
The sanctions also cover several companies tied to the scheme:
• Chinyong – Already sanctioned in 2024, accused of deploying teams of fake IT workers in Russia and Laos.
• Shenyang Geumpungri – A Chinese firm employing North Korean IT workers.
• Sinjin – A North Korean front company for the fraudulent hiring operations.
The U.S. government has repeatedly warned about North Korea’s reliance on cybercrime and fraudulent employment to generate funds, with billions already stolen through hacking and crypto theft. Security firm CrowdStrike estimates that North Korean operatives have successfully infiltrated hundreds of U.S. companies in recent years using forged documents and deceptive recruitment tactics.
The new sanctions bar U.S. businesses, and any foreign companies connected to them, from engaging with the individuals or entities listed. In effect, the move places additional responsibility on employers to ensure they are not inadvertently hiring sanctioned North Korean workers.
While North Korea’s tactics are not new, officials warn they are becoming increasingly sophisticated and harder to detect.
