Wed 28 Oct
US Treasury (OFAC) sanctions 10 individuals and one entity over North Korean IT worker schemes, including Russian money launderers Vitold Obertas and Ilya Boykov and the Russia-based First Financial and Technical Development Center
The US Treasury Department's Office of Foreign Assets Control (OFAC) said on 28 October 2026 that it had sanctioned 10 individuals and one entity for their roles in North Korean (DPRK) government-run IT worker schemes that defraud US businesses and generate revenue for North Korea's weapons of mass destruction and ballistic missile programs. Treasury says Russian national Vitold Viktorovich Obertas is an intermediary for illicit DPRK financial transactions, including for Amnokgang Technology Development Company (designated by OFAC on 12 March 2026), and has since January 2025 conducted nearly $2 million worth of cryptocurrency conversions and at least $1.25 million in other currency transactions for DPRK officials. Russian national Ilya Aleksandrovich Boykov has since 2024 supported Limited Liability Company Alis (designated in March 2024) by exchanging and converting an equivalent of $3.5 million in cryptocurrency transactions and providing logistical support. Kim Ki Hyok leads a Russia-based delegation of Alis IT workers and has transferred cryptocurrency for it valued at nearly $500,000 since 2024; Kim Hyo Dong leads a separate Russia-based Chinyong-subordinate delegation and has facilitated the transfer of over $100,000 in financial assets. The First Financial and Technical Development Center (FFTDC), a DPRK-controlled entity in Russia, was designated for exporting North Korean workers; Treasury says its IT workers use 'Super Intelligence (SI) tools' and complex cryptocurrency transfers, and that six Russia-based DPRK IT workers (Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan and Hyon Se Il), also designated, collectively generated over $750,000 for it since 2025. Treasury says DPRK IT workers have also used their access to corporate networks to deploy malware, exfiltrate sensitive data and steal proprietary information, and that the United States is joined this month by Australia and the European Union in designating individuals and entities supporting the DPRK. The Record (28 Oct) also reported the action.