North Korea IT fraud sanctions

U.S. Sanctions North Korean ‘Remote IT Worker’ Fraud Network

The UBJ Desk

The UBJ Desk

— 1 min read
Share
U.S. Sanctions North Korean ‘Remote IT Worker’ Fraud Network

The U.S. Treasury has slapped sanctions on a global fraud network that enabled North Korea to infiltrate American companies using fake “remote IT workers.” These operatives posed as legitimate job applicants using forged identities and sneaked into companies not only to collect salaries but also to steal data and extort their employers. The Treasury estimates that the network generated at least $1 million for North Korea’s sanctioned weapons programs, including its nuclear development efforts.

Who and What Were Targeted

In this crackdown, several key entities and individuals were designated:

  • Vitaliy Sergeyevich Andreyev, a Russian national, was accused of laundering nearly $600,000 in stolen funds into cryptocurrency for North Korea via a company named Chinyong—a known DPRK-linked front that places IT workers in Russia and Laos.
  • The Chinese front company Shenyang Geumpungri and the North Korean entity Sinjin were also sanctioned. Shenyang reportedly deployed DPRK IT workers, generating over $1M in profits for entities tied to North Korea’s defense apparatus.

Broader Pattern of Remote Worker Scams

This action builds on past efforts by the U.S. Justice and Treasury departments to dismantle North Korea’s cyber-fraud schemes:

  • Courts have charged U.S.-based facilitators who established "laptop farms" and shell companies to help North Korean operatives gain remote jobs in over 100 U.S. companies, netting at least $3 million in damages.
  • The Department of Justice pursued civil forfeiture of $7.7 million in cryptocurrency traced back to such laundering networks tied to DPRK cyber actors.

Why It Matters

These sanctions underscore a growing cybersecurity threat: nation-states using legitimate-looking employment to breach corporate defenses. With remote work becoming standard, such tactics not only facilitate revenue generation for rogue regimes but also jeopardize sensitive data and intellectual property.

Companies must ramp up identity verification—double-checking resumes, conducting in-person onboarding, and monitoring for deepfake or AI-assisted fraud. These precautions are more critical than ever.

Read more