Pull to refresh
Logo
What Changed
Following Why Sign Up
Treasury sanctions North Korean and Russian facilitators of IT worker fraud

Treasury sanctions North Korean and Russian facilitators of IT worker fraud

Force in Play

Ten people and one company designated in second network takedown of 2026

Yesterday: Ten people and one entity designated

Overview

Updated 59 minutes ago

The Treasury Department's Office of Foreign Assets Control (OFAC) blocked the US assets of ten people and one entity on October 28. They ran North Korea's information technology worker fraud scheme—a state operation that places fake employees in US companies and funnels most of their pay to Pyongyang's weapons programs.

The action is the second network takedown this year and the first to name Russian nationals as paid intermediaries. They converted millions in cryptocurrency and handled logistics for the fake workers. Treasury estimates the scheme generates hundreds of millions of dollars a year.

Why it matters

Any company hiring remote tech workers could unknowingly employ North Korean agents who steal data while their paychecks fund weapons programs.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

11
People and entity designated
Ten individuals and one company named by OFAC on October 28, 2026
$2M
Crypto converted by Russian intermediary Obertas
Since January 2025, plus at least $1.25 million in other currencies, for DPRK officials
$3.5M
Crypto exchanged by Russian facilitator Boykov
Treasury says Boykov converted cryptocurrency for Alis, the Russia-registered IT firm, since 2024
$750K
Revenue generated by six FFTDC workers
Collected by designated workers for the North Korea-controlled center since 2025
85–90%
Share of IT worker revenue held by Pyongyang
FBI estimate of the cut the regime takes from the scheme

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

VO
Vitold Viktorovich Obertas
Russian intermediary for illicit DPRK financial transactions
Designated by OFAC on October 28, 2026
IB
Ilya Aleksandrovich Boykov
Russian crypto exchanger and logistics supporter for Alis
Designated by OFAC on October 28, 2026
KH
Kim Ki Hyok
Lead of Russia-based DPRK IT worker delegation under Alis
Designated by OFAC on October 28, 2026
KD
Kim Hyo Dong
Lead of Russia-based DPRK IT worker delegation under Chinyong
Designated by OFAC on October 28, 2026

Organizations Involved

FF
First Financial and Technical Development Center
North Korea-controlled entity in Russia
Designated by OFAC on October 28, 2026

A North Korea-controlled entity in Russia that deploys IT workers abroad.
U.S. Treasury — Office of Foreign Assets Control (OFAC)
U.S. Treasury — Office of Foreign Assets Control (OFAC)
Federal Agency — Treasury Department sanctions unit
Enforcing body; running ongoing campaign against DPRK IT worker networks

The Treasury office that administers and enforces US economic sanctions.
CI
Chinyong Information Technology Cooperation Company
North Korean IT company
Designated by OFAC in May 2023

The North Korean firm at the root of the IT worker network.
LL
Limited Liability Company Alis
Russia-registered IT worker firm
Designated by OFAC in March 2024

A Russia-registered firm subordinate to Chinyong that manages IT worker delegations.

Timeline

May 2023 October 2026

5 events Latest: Yesterday
Tap a bar to jump to that date

  1. Ten people and one entity designated

    Latest Sanctions

    OFAC designated ten individuals and the First Financial and Technical Development Center for running IT worker fraud, including Russian crypto intermediaries. Australia and the EU joined with parallel designations.

  2. FBI warns of facilitator expansion

    Investigation

    The FBI's Internet Crime Complaint Center issued an alert on IT workers expanding the use of paid facilitators, including laptop farms and third-country freelancers.

  3. First network takedown of 2026

    Sanctions

    Treasury designated a separate DPRK IT worker network including Amnokgang Technology Development Company, which handles worker payroll.

  4. OFAC designates Alis

    Sanctions

    Treasury designated Alis, a Russia-registered firm, for being subordinate to Chinyong and managing IT worker delegations.

  5. OFAC designates Chinyong

    Sanctions

    Treasury designated Chinyong Information Technology Cooperation Company, first public naming of the firm at the center of DPRK IT outsourcing.

Scenarios

1

Treasury names more facilitators in new designations

Likely Resolves by Q2 2027

Discussed by: Treasury's October 28 release says it will continue exposing and disrupting these networks with partners including the Multilateral Sanctions Monitoring Team

Treasury called the network's reach 'permeating' the global financial system and this action the second in seven months. The FBI's October alert counted 'dozens of IT worker teams' hiring paid facilitators, suggesting more nodes remain unnamed. Designations are administrative; additional ones cost little to issue.

2

Prosecutors file criminal charges against IT fraud facilitators

Possible Resolves by Q2 2027

Discussed by: FBI's Internet Crime Complaint Center, whose October 13 alert signals active investigation

Sanctions freeze assets but carry no jail time. The FBI's alert shows investigative groundwork. Charges against named Russian facilitators would require arrest abroad—a high bar—but the US has pursued DPRK cyber operators criminally before, including the 2018 indictment of a Lazarus Group programmer.

3

Corporate vetting slows North Korean infiltration

Possible Resolves by End of 2027

Discussed by: FBI IC3 alert (October 13, 2026), which notes improved private-sector detection is pushing IT workers to adopt costlier evasion methods

The FBI says stronger corporate detection is one reason IT workers now hire paid facilitators and subcontract work to freelancers in Pakistan, India, and Nigeria. If major employers adopt mandatory in-person checks or stricter identity verification for remote hires, the cost of infiltrating rises. The FBI's alert lays out detection steps companies can take.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

September 2017 – December 2019

UN worker export ban (2017–2019)

UN Security Council Resolution 2375, adopted in September 2017, required member states to repatriate North Korean guest workers by the end of 2019. Pyongyang had exported workers across Asia and Eastern Europe, who faced quotas sending most of their wages home.

Then

Most member states sent the workers home, ending a legal revenue stream for the regime by December 2019.

Now

North Korea shifted the same model online, using remote IT workers who collect foreign salaries without leaving the country.

Why this matters now

The IT worker scheme is the digital successor to the worker export program that UN sanctions shut down.

September 2019

Lazarus Group sanctions (2019)

Treasury designated the Lazarus Group, a Pyongyang-linked hacking unit, for its role in WannaCry and the 2016 theft of $81 million from Bangladesh's central bank. The Justice Department separately indicted programmer Park Jin Hyok.

Then

Treasury froze the group's US-based assets and named its front companies.

Now

The designation established the pattern of naming specific DPRK cyber actors and their facilitators, extending now to the IT worker network.

Why this matters now

Like the Lazarus Group, the IT worker network shows North Korea using the internet to generate hard currency for weapons programs.

Sources

(5)
U.S. Department of the Treasury FBI Internet Crime Complaint Center CBS News NBC News Chainalysis