Fraud & Identity Theft

US Sanctions Russian National, Chinese Firm Aiding North Korean IT Workers

US Treasury sanctions Russian and Chinese entities tied to North Korea’s use of fake IT workers, who exploited stolen identities, AI, and malware to funnel millions back to Pyongyang.

North Korea hackers

The US Treasury Department’s Office of Foreign Assets Control (OFAC) on Wednesday announced sanctions against a Russian national and a Chinese company for their roles in North Korean fraudulent IT worker schemes.

Over the past several years, hundreds of US companies are believed to have been duped into hiring North Korean nationals that used false or stolen identities to obtain IT employment and funnel the fraudulently obtained revenue to the Pyongyang regime.

Using fraudulent documents, stolen personal information, and AI to hide their true identities, and aided by individuals and organizations in the US and elsewhere to hide their location, these fake IT workers netted hundreds of millions of dollars, the US Treasury says.

In some cases, the fraudulent IT workers deployed malware on their employers’ networks, to steal sensitive data. Some of them engaged in extortion tactics.

On Wednesday, OFAC designated Vitaliy Sergeyevich Andreyev, a Russian national, for facilitating payments to Chinyong Information Technology Cooperation Company, a Chinese firm sanctioned by the US.

Working with Kim Ung Sun, a Russia-based North Korean economic and trade consular official, Andreyev facilitated the transfer of approximately $600,000 through the conversion of cryptocurrency to cash, the US Treasury says.

Advertisement. Scroll to continue reading.

The OFAC also designated Shenyang Geumpungri Network Technology Co., Ltd, a Chinese front company for Chinyong.

Since 2021, the office says, Shenyang Geumpungri’s delegation of North Korean IT workers earned over $1 million in revenue for Chinyong and for North Korean company Korea Sinjin Trading Corporation, which is subordinated to the Pyongyang government.

As a result of the sanctions, all US property and interest in property of the designated entities are blocked, and individuals and organizations in the US are prohibited from making transactions with the designated entities.

Related: US Targets North Korea’s Illicit Funds: $15M Rewards Offered as American Woman Jailed in IT Worker Scam

Related: US Storms 29 Laptop Farms in Crackdown on North Korean IT Worker Schemes

Related: Developer Who Hacked Former Employer’s Systems Sentenced to Prison

Related:Microsoft to Lay Off About 3% of Its Workforce

Related Content

Cybercrime

Investigators stormed 40 locations in Texas and seized 187 laptops used by North Korean IT workers to hide their location.

Cybercrime

Bitget’s security systems caught the unauthorized transfers on September 24, and some wallet addresses linked to the attacker have been frozen.

Nation-State

The US, Japan, Germany and Australia have published a joint report detailing the scope of North Korea’s WaterPlum campaign.

Supply Chain Security

It’s unclear if the attacks are part of previous campaigns against Rust, but the techniques used by the attackers match those used by North...

Malware & Threats

The stealthy toolkit embeds a backdoor in HAProxy and targets automotive and media organizations in South Korea for long-term surveillance.

Malware & Threats

Hackers pushed a poisoned arrayref version that added a dependency to fetch a malicious payload from a remote server.

Vulnerabilities

The bug allowed attackers to gain full control of the victims’ systems and deploy the ForestTiger backdoor.

Supply Chain Security

The PolinRider campaign has compromised more than 100 legitimate open source packages and repositories to deliver a backdoor and information stealer to developers.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.

Exit mobile version