US sanctions facilitators of North Korean IT worker schemes targeting businesses

Overview

On October 28, 2026, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned 10 individuals and one entity for their roles in Democratic People’s Republic of Korea (DPRK) government-run information technology (IT) worker schemes. OFAC alleges that these schemes use fraudulent documents, stolen identities, and fabricated personas to obtain employment with legitimate businesses, including in the United States, and generate revenue for the DPRK government.

According to the OFAC press report, the networks targeted by the action have used cryptocurrency transactions, money laundering techniques, and emerging technologies, including artificial intelligence tools, to generate and transfer funds. OFAC also states that DPRK IT workers have exploited access to corporate networks to deploy malware, exfiltrate sensitive data, and steal proprietary information. The action follows OFAC’s March 12, 2026, designation of a separate DPRK IT worker network and comes amid broader international efforts to target the DPRK’s revenue-generation activities.

Facilitators of DPRK IT worker networks

OFAC’s action targets individuals involved in facilitating DPRK IT worker activity and moving funds generated through these schemes. Specifically, OFAC designated Russian national Vitold Viktorovich Obertas, whom OFAC describes as an intermediary for DPRK financial transactions. OFAC alleges that, since January 2025, Obertas allegedly has conducted nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions for DPRK officials. OFAC also designated Obertas pursuant to Executive Order 13687 for providing support to the government of North Korea.

OFAC additionally designated DPRK nationals Kim Ki Hyok and Kim Hyo Dong, who OFAC states lead separate Russia-based DPRK IT worker delegations. According to OFAC, Kim Ki Hyok transferred nearly $500,000 in cryptocurrency for his delegation, while Kim Hyo Dong facilitated transfer of the equivalent of more than $100,000 in financial assets and provided logistical assistance to another delegation.

Russian national Ilya Aleksandrovich Boykov was also designated. OFAC states that Boykov supported previously designated limited liability company Alis by exchanging or converting approximately $3.5 million in cryptocurrency transactions and providing other support.

Russia-based DPRK IT worker operation

OFAC also designated the First Financial and Technical Development Center (FFTDC), which OFAC describes as a DPRK-controlled entity located in Russia that uses DPRK IT workers to generate revenue for the DPRK government. OFAC designated FFTDC pursuant to Executive Order 13722 for engaging in, facilitating, or being responsible for the exportation of workers from North Korea, including for purposes of generating revenue for the government of North Korea or the Workers’ Party of Korea.

OFAC additionally designated six Russia-based DPRK IT workers linked to FFTDC: Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan, and Hyon Se Il. OFAC states that the six individuals collectively have generated more than $750,000 for FFTDC since 2025.

Key risks for businesses

The October 28 action highlights that DPRK IT worker schemes may present risks extending beyond sanctions compliance. OFAC states that DPRK IT workers have exploited corporate-system access to deploy malware, exfiltrate sensitive data, and steal proprietary information.

U.S. and international authorities have issued guidance identifying indicators of potential DPRK IT worker activity. These include the use of false or stolen identities, third-party proxies, VPNs and remote-access tools, “laptop farms,” payment in cryptocurrency or through third-party accounts, and inconsistencies concerning an individual’s identity, location, employment history, or working patterns. Authorities recommend measures including enhanced identity verification, independent verification of employment and education histories, scrutiny of payment information and company-device shipping arrangements, and controls addressing remote access to corporate systems. 

The action therefore reinforces the importance of coordination among sanctions compliance, recruitment, information security, and payment functions, particularly for businesses hiring remote technology workers or using third-party IT providers. We are happy to discuss these topics in further detail.

Sanctions implications

As a result of the designations, property and interests in property of the designated or otherwise blocked persons that are in the United States or in the possession or control of U.S. persons are blocked and must be reported to OFAC. Entities owned, directly or indirectly, individually or in the aggregate, 50% or more by one or more blocked persons are also blocked. Unless a transaction is exempt or authorized by OFAC, OFAC’s regulations generally prohibit transactions by U.S. persons or within or transiting the United States involving property or interests in property of blocked persons.

OFAC also notes that certain transactions involving persons designated in the action may create secondary sanctions exposure for participating foreign financial institutions.

Key takeaways

The October 28 action demonstrates OFAC’s continued focus on the financial infrastructure supporting DPRK IT worker schemes, including cryptocurrency transactions and Russia-based facilitators and IT worker operations. For a list of all parties targeted in this action, refer to this link. 

For businesses, the action also underscores the importance of controls designed to identify potentially fraudulent remote workers before they obtain access to corporate systems. Companies employing remote technology personnel, directly or through third-party providers, should consider whether their recruitment, identity-verification, device-management, payment, cybersecurity, and sanctions controls appropriately address the indicators identified by U.S. and international authorities. We are closely monitoring further developments relating to U.S. sanctions targeting DPRK IT worker schemes. We are also happy to discuss the issues above in further detail.

***

We encourage you to subscribe to be kept informed of the latest developments. Please contact the authors or your usual HSF Kramer contacts for more information.