Treasury slaps sanctions on people, companies tied to North Korean IT worker schemes

A North Korean man was the focus of Tuesday’s announcement, which also included a Russian man, his companies and North Korean firms.

The Treasury Department on Tuesday announced it has sanctioned a North Korean man participating in the widespread IT worker scheme, as well as others in a Russia-based IT worker operation that allegedly benefits the government of North Korea.

It’s the second time in as many weeks that feds have taken action against people it says are associated with the IT worker scam — which benefits the illicit aims of the Democratic People’s Republic of Korea — following last week’s arrest, indictments and seizures.

“Today’s action underscores the importance of vigilance on the DPRK’s continued efforts to clandestinely fund its WMD and ballistic missile programs,” Deputy Secretary of the Treasury Michael Faulkender said in a news release. 

Treasury’s Office of Foreign Assets Control levied the sanctions against Song Kum Hyok, whom it said was associated with the North Korea government-linked hacking group Andariel, also known as Onyx Sleet. That hacker outfit is thought to be a subset of the umbrella Lazarus Group.

“Song facilitated an information technology (IT) worker scheme in which individuals, often DPRK nationals working from countries such as China and Russia, were recruited and provided with falsified identities and nationalities to obtain employment at unwitting companies to generate revenue for the DPRK regime,” a Treasury press release states. “In some cases, these DPRK IT workers have been known to introduce malware into company networks for additional exploitation.”

It also levied sanctions against Gayk Asatryan, a Russian man whom the department said used his Russia-based companies to employ North Korean IT workers. Treasury additionally sanctioned four companies, two of which are his: Songkwang Trading, which the agency said Asatryan had signed a deal to dispatch 30 IT workers to his company Asatryan LLC, as well as Saenal Trading, which signed a deal to dispatch 50 IT workers to Fortuna LLC.

It marks the third time Treasury has issued sanctions related to North Korean hackers.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure