U.S. blocks assets of 10 North Koreans and Russians in IT fraud network

The U.S. Treasury Department announced on Wednesday that it has blocked the assets of 10 individuals and one organization tied to a North Korean scheme to place fraudulent IT workers in American and allied firms. These designations target the financial infrastructure that allows the state-run operation to siphon hundreds of millions of dollars for its weapons of mass destruction and ballistic missile programs.

The fraud scheme relies on North Korean operatives posing as legitimate technology professionals. They secure positions at unwitting companies and remit the majority of their salaries back to the regime. Once inside corporate networks, these workers can access sensitive data, deploy malware, and extort their employers.

Investigators identified key components of this financial network operating in Russia. The Treasury's Office of Foreign Assets Control designated Vitold Viktorovich Obertas, a Russian national who acts as an intermediary for North Korean officials. Since January 2025, Obertas has processed nearly $2 million in cryptocurrency conversions and at least $1.25 million in additional currency transactions.

The sanctions also include Kim Ki Hyok, a North Korean national who leads an IT worker delegation in Russia. He is responsible for monitoring personnel and ensuring the group meets financial targets. Since 2024, he has transferred nearly $500,000 in cryptocurrency on behalf of the delegation.

The Treasury also designated the First Financial and Technical Development Center, a Russia-based organization controlled by North Korea. The center has generated millions for the regime by procuring highly trained IT workers for jobs in the U.S. and worldwide while managing cryptocurrency transfers. Six of its own operatives were designated alongside the organization.

All U.S.-linked property and interests in property of the designated persons are now blocked. Americans and U.S. residents are generally prohibited from engaging with these entities. The action aims to dismantle the machinery that converts fraudulent employment into illicit revenue for North Korea's military programs.

The Treasury stated that the scheme uses stolen identities and fake resumes to infiltrate legitimate businesses. The proceeds from these fraudulent positions directly fund North Korea's weapons of mass destruction and ballistic missile development efforts.