The U.S. Treasury Department sanctioned 10 people and one company that it says help North Korea's government place IT workers in remote jobs at U.S. businesses and move their earnings home, the department announced Wednesday. Treasury says the workers use AI tools among other technologies, a reminder for employers that checking who they hire for remote technical work is a security control, and that paying the wrong contractor can become a sanctions problem.
What Happened
Treasury's Office of Foreign Assets Control (OFAC) designated two Russian nationals it describes as financial intermediaries. It says Ilya Boykov has exchanged and converted about $3.5 million in cryptocurrency since 2024 for Alis, a North Korean company that runs IT workers, and that Vitold Obertas has carried out nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025.
OFAC also designated Kim Ki Hyok and Kim Hyo Dong, North Koreans who Treasury says lead Russia-based delegations of IT workers, along with six Russia-based North Korean IT workers. The company is the First Financial and Technical Development Center, a North Korean-controlled firm in Russia that Treasury says has generated several million dollars through IT workers since at least 2024. Its workers reportedly use "Super Intelligence (SI) tools" and complex cryptocurrency transfers, according to the release.
"The North Korean regime continues targeting and exploiting American companies through fraudulent activities," Treasury Secretary Scott Bessent said in the release.
Why It Matters
Treasury says the workers use forged documents, stolen identities and invented personas to get hired at legitimate companies in the U.S. and allied countries, and that some have used their network access to deploy malware, take sensitive data and steal proprietary information. Their wages largely go to the government in Pyongyang and help fund its weapons of mass destruction and ballistic missile programs, the department says.
The legal exposure is direct. U.S. persons are generally barred from dealing with anyone designated, and OFAC can impose civil penalties on a strict liability basis, meaning a company can be penalized without having known it was dealing with a sanctioned person. Hiring, staffing and payroll screening should now include the new names.
Context
The action builds on OFAC's March 12 designation of Amnokgang Technology Development Company, and Treasury says Australia and the European Union designated people and entities supporting North Korean revenue generation earlier this month.
The Justice Department disrupted laptop farms in Texas about two weeks ago, The Record reported; these are sites where U.S.-based helpers host company laptops so overseas workers appear to log in from inside the country. The Primary Wire reported Oct. 13, citing the Justice Department, that prosecutors charged 14 people in a scheme tied to more than 70 U.S. employers. The FBI has said North Korea is now recruiting Americans facing financial stress to host laptops or sit job interviews, The Record reported.
What to Watch
Further designations and Justice Department cases against U.S.-based facilitators, and how quickly identity checks for remote hires adapt to AI-assisted applicants.
