Treasury sanctions 10 North Koreans and Russians over IT worker fraud scheme

The Treasury Department has sanctioned 10 North Koreans and Russians powering Pyongyang's sprawling IT worker fraud enterprise — a state-run operation that churns out stolen identities, fake résumés and fake IT employees who infiltrate legitimate businesses. The hundreds of millions of dollars in proceeds are then used to fund North Korea's weapons of mass destruction and ballistic missile programs. 

The scheme is simple: North Korean operatives pose as legitimate IT professionals, secure jobs at unwitting U.S. and allied companies, and funnel the majority of their pay back to the regime. Once inside corporate networks, these workers can also access sensitive data, deploy malware and even extort their employers.

In diving into the global web of handlers, financial intermediaries and money launderers bolstering the fake identities, investigators discovered key parts of that machinery operating in Russia. Among those designated Wednesday is Russian national Vitold Viktorovich Obertas, an intermediary who has facilitated financial transactions for North Korean officials. Since January 2025, Obertas has processed nearly $2 million in cryptocurrency conversions and at least $1.25 million in additional currency transactions for DPRK officials. 

The Treasury's Office of Foreign Assets Control also sanctioned North Korean national Kim Ki Hyok, who leads an IT worker delegation in Russia and is responsible for monitoring the group's personnel and ensuring they meet financial targets. Since 2024, he has transferred nearly $500,000 in cryptocurrency on behalf of the delegation. 

The Treasury also sanctioned the Russia-based, North Korean-controlled First Financial and Technical Development Center, which has generated millions for the regime by procuring highly trained IT workers for jobs in the U.S. and worldwide and operating cryptocurrency transfers behind the scenes. Six of its own operatives were designated alongside the organization.

All U.S.-linked property and interests in property of the designated persons have now been blocked, and Americans and U.S. residents are generally prohibited from engaging with them. The action goes beyond targeting individual fraudsters — it's an effort to begin dismantling the machinery that converts fraudulent employment into illicit revenue — and ultimately into funding for North Korea's weapons programs.