Treasury Sanctions 10 North Koreans and Russians Over IT Worker Fraud Scheme

The U.S. Treasury Department announced sanctions on Wednesday against 10 North Koreans and Russians accused of powering Pyongyang's sprawling IT worker fraud enterprise. Officials describe it as a state-run operation that produces stolen identities, fake résumés and bogus IT employees who infiltrate legitimate businesses.

The proceeds, which amount to hundreds of millions of dollars, are used to fund North Korea's weapons of mass destruction and ballistic missile programs, according to the Treasury.

The scheme works in a straightforward way. North Korean operatives pose as legitimate IT professionals and land jobs at unwitting U.S. and allied companies, then send most of their pay back to the regime. Once inside a company's network, these workers can also reach sensitive data, deploy malware and even extort their employers.

As investigators traced the global web of handlers, financial intermediaries and money launderers that supports the false identities, they found key parts of the machinery operating in Russia. One of those designated Wednesday is Russian national Vitold Viktorovich Obertas, an intermediary who has helped North Korean officials carry out financial transactions. Since January 2025, Obertas has processed nearly $2 million in cryptocurrency conversions and at least $1.25 million in additional currency transactions for officials of the Democratic People's Republic of Korea.

The Treasury's Office of Foreign Assets Control also sanctioned North Korean national Kim Ki Hyok. He leads an IT worker delegation in Russia and is responsible for monitoring its personnel and making sure they meet financial targets. Since 2024, he has transferred nearly $500,000 in cryptocurrency on behalf of the delegation.

Another target is the First Financial and Technical Development Center, a Russia-based organization controlled by North Korea. The Treasury says it has generated millions of dollars for the regime by procuring highly trained IT workers for jobs in the United States and around the world, while also running cryptocurrency transfers behind the scenes. Six of its operatives were designated along with the organization itself.

As a result of the action, all property and interests in property of the designated persons that are linked to the United States have been blocked. Americans and U.S. residents are generally prohibited from dealing with them.

The move goes beyond going after individual fraudsters. It is an effort to begin dismantling the machinery that converts fraudulent employment into illicit revenue, and ultimately into funding for North Korea's weapons programs.