Particle.news

Download on the App Store

U.S. Sanctions Two People and Two Firms Tied to North Korea’s Fake IT Worker Scheme

Treasury says the operation laundered about $600,000 into cryptocurrency, generating at least $1 million for Pyongyang.

SEOUL, SOUTH KOREA - 2025/05/09: People watch a 24-hour Yonhap News TV broadcast on a large screen at Seoul Railway Station, showing footage of a joint striking drill involving long-range artillery and missile systems conducted by the Korean People's Army eastern front division at an undisclosed location in North Korea. North Korean leader Kim Jong Un oversaw a joint striking drill involving long-range artillery and a new variant of tactical ballistic missiles, reaffirming the combat readiness of the country’s nuclear forces, state media KCNA reported on May 9. The exercise featured a 600mm multiple rocket launcher and the Hwasongpho-11-Ka tactical ballistic missile. South Korea’s military detected multiple short-range ballistic missile launches from Wonsan between 8:10 and 9:20 a.m. on May 8—North Korea’s fourth missile test of the year. (Photo by Kim Jae-Hwan/SOPA Images/LightRocket via Getty Images)
This file photo, released by Reuters, shows a sign marking the U.S Treasury Department in Washington, D.C., on Aug. 6, 2018. (Yonhap)
Image
Image

Overview

  • OFAC designated North Korean national Kim Ung-sun, Russian national Vitaliy Sergeyevich Andreyev, Korea Sinjin Trading Corporation, and China-based Shenyang Geumpungri Network Technology.
  • Treasury alleges Andreyev worked with Kim to convert roughly $600,000 into cryptocurrency and to route payments to the previously sanctioned Chinyong Information Technology Cooperation Company.
  • Shenyang Geumpungri is described as a Chinese front for Chinyong’s delegation of North Korean IT workers, while Korea Sinjin operates under the regime’s General Political Bureau and has directed deployments.
  • The designations freeze applicable U.S. assets and bar transactions with the listed parties, placing due‑diligence obligations on employers to avoid hiring sanctioned or misrepresented workers.
  • Officials say the fraud network infiltrates companies to steal data and demand ransoms and that State, South Korea, and Japan issued a joint warning about the threat.