Treasury sanctions North Korea IT worker scheme facilitators and front organizations

As the sanctions-evading scheme has grown, so too has the U.S. government’s response.

The Treasury Department on Wednesday expanded efforts to disrupt the pervasive North Korean technical worker scheme by imposing sanctions on people and organizations serving as facilitators and fronts for the country’s years-long conspiracy effort to defraud businesses and earn money despite international sanctions. 

Vitaly Sergeyevich Andreyev, Kim Ung Sun, Shenyang Geumpungri Network Technology and Korea Sinjin Trading Corp. were all sanctioned by the Treasury Department’s Office of Foreign Assets Control for their alleged roles in the scheme orchestrated by the North Korean government. 

Officials accuse the regime of hatching and maintaining an expansive operation that funnels money to its weapons and missiles programs by placing teams of specialized workers in IT jobs in the United States and elsewhere using fraudulent documents, stolen identities and false personas to hide their North Korean nationality.

“The North Korean regime continues to target American businesses through fraud schemes involving its overseas IT workers, who steal data and demand ransom,” John K. Hurley, under secretary of the Treasury for terrorism and financial intelligence, said in a written statement.

As the sanctions-evading scheme has grown, so too has the U.S. government’s response. Officials continue to target people and organizations involved, and Wednesday’s action follows the Justice Department’s seizure of $7.74 million from North Korean nationals who allegedly attempted to launder cryptocurrency obtained by IT workers who gained illegal employment as part of the scheme. 

Andreyev, a 44-year-old Russian national, allegedly facilitates payments to Chinyong Information Technology Cooperation Co., an outfit associated with North Korea’s Ministry of Defense that was targeted in the cryptocurrency seizure and previously sanctioned, according to the Treasury Department. Chinyong employs teams of IT workers in Russia and Laos, according to officials.

“Since at least December 2024, Andreyev has worked with Kim Ung Sun, a Russia-based Democratic People’s Republic of Korea economic and trade consular official, to facilitate multiple financial transfers worth a total of nearly $600,000, by converting cryptocurrency to cash in U.S. dollars,” the Treasury Department said in the sanctions announcement.

Officials said Shenyang Geumpungri is a Chinese front company for Chingyong, which manages a group of North Korean IT workers that have earned more than $1 million in profits for Chinyong and Sinjin, an affiliate of the regime’s General Political Bureau.

The Treasury Department earlier this summer imposed another set of sanctions on people and organizations allegedly involved in the North Korea IT worker scheme. In late July, the State Department announced a reward up to $15 million for information leading to the arrest of seven North Korean nationals accused of multiple crimes, including cryptocurrency theft, fraudulent remote IT work and tobacco smuggling.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure