Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Fraud & Identity Theft

US Sanctions Russian National, Chinese Firm Aiding North Korean IT Workers

US Treasury sanctions Russian and Chinese entities tied to North Korea’s use of fake IT workers, who exploited stolen identities, AI, and malware to funnel millions back to Pyongyang.

North Korea hackers

The US Treasury Department’s Office of Foreign Assets Control (OFAC) on Wednesday announced sanctions against a Russian national and a Chinese company for their roles in North Korean fraudulent IT worker schemes.

Over the past several years, hundreds of US companies are believed to have been duped into hiring North Korean nationals that used false or stolen identities to obtain IT employment and funnel the fraudulently obtained revenue to the Pyongyang regime.

Using fraudulent documents, stolen personal information, and AI to hide their true identities, and aided by individuals and organizations in the US and elsewhere to hide their location, these fake IT workers netted hundreds of millions of dollars, the US Treasury says.

In some cases, the fraudulent IT workers deployed malware on their employers’ networks, to steal sensitive data. Some of them engaged in extortion tactics.

On Wednesday, OFAC designated Vitaliy Sergeyevich Andreyev, a Russian national, for facilitating payments to Chinyong Information Technology Cooperation Company, a Chinese firm sanctioned by the US.

Working with Kim Ung Sun, a Russia-based North Korean economic and trade consular official, Andreyev facilitated the transfer of approximately $600,000 through the conversion of cryptocurrency to cash, the US Treasury says.

Advertisement. Scroll to continue reading.

The OFAC also designated Shenyang Geumpungri Network Technology Co., Ltd, a Chinese front company for Chinyong.

Since 2021, the office says, Shenyang Geumpungri’s delegation of North Korean IT workers earned over $1 million in revenue for Chinyong and for North Korean company Korea Sinjin Trading Corporation, which is subordinated to the Pyongyang government.

As a result of the sanctions, all US property and interest in property of the designated entities are blocked, and individuals and organizations in the US are prohibited from making transactions with the designated entities.

Related: US Targets North Korea’s Illicit Funds: $15M Rewards Offered as American Woman Jailed in IT Worker Scam

Related: US Storms 29 Laptop Farms in Crackdown on North Korean IT Worker Schemes

Related: Developer Who Hacked Former Employer’s Systems Sentenced to Prison

Related:Microsoft to Lay Off About 3% of Its Workforce

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Delve into big-picture strategies to reduce attack surfaces, improve patch management, conduct post-incident forensics, and tools and tricks needed in a modern organization.

Register

Organizations are investing heavily in third-party risk management, but breaches, delays, and blind spots continue to persist. Join this live webinar as we examine the gap between how organizations think their third-party risk programs are performing and what’s actually happening in practice.

Register

People on the Move

Rapid7 announced that Wael Mohamed will assume the role of Chief Executive Officer, replacing current Chief Executive Officer Corey Thomas, who will become Executive Chairman of the Board.

Anurag Jain has been appointed Senior Vice President of Engineering at CodeHunter.

CTERA has appointed Tal Sarfaty as Senior Vice President of Cybersecurity.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.