OFAC sanctions 10 individuals and one entity over North Korean IT scheme

The Treasury Department’s Office of Foreign Assets Control on Oct. 28, 2026, sanctioned 10 individuals and one entity for their roles in North Korean government-run schemes that defraud American businesses by placing information technology workers at them and that raise money for the country’s illegal weapons of mass destruction and ballistic missile programs.

The single sanctioned entity is the First Financial and Technical Development Center, which the Treasury Department described as a North Korean government-controlled body based in Russia. Since 2024, the center has employed North Korean information technology workers in Russia, and those workers earned several million dollars for North Korea’s government.

Six North Korean information technology workers based in Russia have made more than $750,000 for the center since 2025. They are Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan and Hyon Se Il. OFAC designated the center and the six workers under Executive Order 13722 for facilitating the exportation of North Korean workers to generate revenue and for supporting the center.

The center’s workers in Russia use Super Intelligence tools and move revenue through complex cryptocurrency transfers and other sophisticated money laundering methods. Those workers have used company network access to install malicious software, take sensitive data and steal proprietary information, creating serious dangers for businesses around the world.

North Korea places its information technology workers at legitimate companies in the United States and allied nations using fraudulent documents, stolen identities and made-up personas. The North Korean government takes most of the workers’ pay, and this pay produces hundreds of millions of dollars for the country’s illegal weapons of mass destruction and ballistic missile programs.

Vitold Viktorovich Obertas, a Russian go-between for unlawful North Korean money transfers, conducted almost $2 million in cryptocurrency conversions and also moved at least $1.25 million worth of other currency for North Korean officials since January 2025. OFAC designated him under Executive Order 13687 because he materially assisted or supported North Korea’s government, including transfers for Amnokgang Technology Development Company, which OFAC designated on March 12, 2026.

Kim Ki Hyok is a North Korean citizen. He leads a Russia-based group of information technology workers for Limited Liability Company Alis. He checks that they reach their money goals. Since 2024, he has moved cryptocurrency worth close to $500,000 for the Alis group. Kim Hyo Dong is a North Korean citizen. He leads a separate Russia-based group for Chinyong Information Technology Cooperation Company. He has given that group logistics help. Since at least December 2023, he also tried to evade sanctions by moving financial assets worth more than $100,000. OFAC designated both men under Executive Order 13687 because they backed Chinyong Information Technology Cooperation Company.

Ilya Aleksandrovich Boykov, a Russian citizen, has since 2024 changed and moved cryptocurrency worth $3.5 million for Limited Liability Company Alis, and he has also watched cryptocurrency transactions and given the group logistics help. OFAC designated him under Executive Order 13687 because he backed Limited Liability Company Alis.

The action fits a sustained pattern rather than a one-off. OFAC’s March 12, 2026 designation covered a different North Korean information technology worker network, and earlier in March 2026 the sanctions hit six individuals and two entities over disguised information technology worker jobs. Australia and the European Union joined with the United States this month to designate people and groups backing North Korea’s money-making and military work.

The sanctions freeze property and interests in property owned by sanctioned people that are in the United States or controlled by Americans, and that property must be reported to OFAC. A business is blocked if sanctioned people own 50 percent or more of it, directly or indirectly, and alone or with others.

OFAC’s rules generally stop Americans, and anyone inside or passing through the United States, from dealing with the property unless OFAC grants a license or an exemption applies. Banks and others face sanctions risk over some dealings involving sanctioned people or groups, including the giving or receipt of funds, goods or services for them.

Earlier this month, the Justice Department arrested two Americans and took about 190 computers, while charging ten people tied to China along with two unnamed defendants. UA.NEWS reports that U.S. officials tied that Justice Department case to an alleged North Korean government campaign against more than 70 companies in America. The Treasury announced the sanctions on Oct. 28, 2026, less than a week after it proposed limiting U.S. high-tech investment in China, Russia and North Korea; the proposal covers deals over $50,000 for hypersonic systems, quantum information technology, high-performance computing, supercomputers and artificial intelligence.

Treasury Secretary Scott Bessent said on Oct. 28, 2026, that North Korea continues to target American companies through fraudulent activity conducted by overseas information technology workers. “The North Korean regime continues to target US companies, using overseas IT operators for fraudulent activities, obtaining sensitive data and extorting substantial payments,” Bessent said.

Treasury works with partners, including the Multilateral Sanctions Monitoring Team Participating States, to uncover and stop networks that help North Korea evade sanctions and raise money for illegal weapons programs. Warnings from the State Department, Treasury Department, Justice Department, the FBI and a multinational police group cover North Korean information technology worker methods and how to protect private networks.