The United States has sanctioned 10 individuals and one organisation over alleged links to North Korea’s overseas IT worker schemes, according to the US Department of the Treasury. The action, announced on October 28, 2026, targets people accused of helping generate revenue through fraudulent employment and financial transactions.
The Treasury’s Office of Foreign Assets Control (OFAC) says these networks help fund North Korea’s weapons of mass destruction and ballistic missile programmes. Several of the targeted individuals allegedly operated in Russia, where they supported IT worker delegations and handled cryptocurrency transactions.
The sanctions aim to disrupt the financial networks behind the schemes and limit their ability to move money through the international financial system.
Official source: US Department of the Treasury’s October 28 announcement.
How North Korea’s IT Worker Fraud Scheme Works
According to the Treasury Department, North Korean operatives use false identities and fabricated documents to obtain jobs with legitimate companies. They may present themselves as qualified software developers or other IT professionals while concealing their connections to North Korea.
Once hired, these workers can earn income from technology services. US authorities allege that much of this money ultimately reaches the North Korean government.
The risks extend beyond financial fraud. Workers who gain access to company systems may also steal confidential information, introduce malware, or use sensitive data to pressure employers into making payments.
These allegations have prompted US authorities to target not only the workers but also the intermediaries who arrange employment, manage personnel and transfer funds.
Russia-Based Financial Networks Face US Sanctions
The latest action focuses partly on individuals accused of helping North Korean IT operations function in Russia.
Russian intermediary linked to cryptocurrency transactions
Russian national Vitold Viktorovich Obertas is among those designated by OFAC.
According to the Treasury Department, Obertas facilitated financial transactions for North Korean officials. Since January 2025, he has allegedly processed nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions.
US authorities say these activities supported North Korean financial networks, including those linked to previously sanctioned entities.
IT delegation leaders accused of moving funds
The Treasury Department also designated North Korean nationals Kim Ki Hyok and Kim Hyo Dong.
Kim Ki Hyok allegedly leads an IT worker delegation in Russia, overseeing personnel and ensuring workers meet financial targets. Since 2024, he has transferred cryptocurrency worth nearly $500,000 on behalf of the delegation, according to US officials.
Kim Hyo Dong allegedly provided logistical support to a separate delegation linked to North Korea’s Chinyong Information Technology Cooperation Company. The Treasury Department says he also supported sanctions evasion efforts and facilitated transfers of more than $100,000 in financial assets since at least December 2023.
Russian national Ilya Aleksandrovich Boykov was also sanctioned. OFAC alleges that he supported the Alis network by exchanging and converting cryptocurrency worth the equivalent of $3.5 million since 2024, monitoring transactions and providing logistical assistance.
The designations highlight the role that financial intermediaries and operational managers can play in supporting overseas employment schemes.
North Korean-Controlled Organisation in Russia Also Targeted
The Treasury Department designated the First Financial and Technical Development Center (FFTDC), a North Korean-controlled organisation based in Russia.
According to US authorities, the organisation deploys skilled North Korean IT workers and uses cryptocurrency transfers and other money-laundering methods to support revenue-generating activities.
The Treasury Department says workers associated with FFTDC generated more than $750,000 for the organisation since 2025.
Six North Korean nationals associated with the organisation were also sanctioned:
- Kim Kyong Ju
- Ri Thae Chol
- So Hyon Jin
- Han Yu Song
- Kim Sung Gwan
- Hyon Se Il
The designations are intended to disrupt the organisation’s alleged role in deploying workers and generating revenue for North Korea.
What the US Sanctions Mean
The sanctions impose restrictions on property and financial interests belonging to the designated individuals and organisations that fall under US jurisdiction.
Under OFAC rules, property and interests in property within the United States or held or controlled by US persons are generally blocked. US persons are also generally prohibited from conducting transactions involving blocked property unless an exemption or authorisation applies.
The restrictions can affect banks, businesses and other organisations that deal with designated parties. Violations may result in civil or criminal penalties, depending on the circumstances and applicable law.
The action also targets entities owned 50% or more, directly or indirectly, and in the aggregate by one or more blocked persons under OFAC’s rules.
These measures are designed to make it harder for the targeted network to access US-linked financial services and move money internationally.
Why North Korean IT Worker Fraud Is a Concern for Businesses
The alleged scheme creates two major risks for companies: financial fraud and cybersecurity exposure.
A fraudulent applicant may use stolen personal information or misleading employment records to obtain a remote position. If hired, that person could gain access to internal systems, proprietary information or customer data.
Businesses can reduce these risks by verifying applicants’ identities, checking professional credentials and investigating inconsistencies in employment histories. Employers should also use multi-factor authentication, limit access to sensitive systems and monitor unusual account activity.
Payment arrangements deserve attention as well. Unexpected requests to route wages or business payments through unrelated parties may warrant additional checks.
However, companies should rely on evidence-based screening procedures rather than assume that a person’s nationality or location indicates wrongdoing.
US Expands Efforts to Disrupt North Korean Revenue Networks
The October 28 sanctions build on a separate US Treasury action announced on March 12, 2026, which targeted six individuals and two entities connected to North Korean IT worker schemes.
The US government has warned that these operations exploit legitimate hiring processes to generate revenue for North Korea while creating potential security risks for employers.
The latest designations also come amid broader international efforts to restrict North Korea’s access to funds used for military programmes. The Treasury Department said Australia and the European Union took related measures during October.
International cooperation is important because the networks can involve workers in one country, financial intermediaries in another and employers elsewhere.
By targeting the people and organisations allegedly coordinating these activities, US authorities aim to disrupt the infrastructure that supports the schemes.
Conclusion
The US sanctions against North Korean IT worker networks mark another effort to restrict the financial channels that allegedly support North Korea’s weapons programmes.
The October 28 action targets 10 individuals and one organisation, including Russian financial intermediaries, North Korean delegation leaders and a Russia-based organisation accused of deploying IT workers.
For businesses, the case underscores the importance of reliable hiring checks, careful access management and effective financial controls. For US authorities, the challenge will be to enforce the sanctions and work with international partners to prevent targeted networks from continuing their activities.
