Treasury Sanctions 10 North Korean and Russian Targets Over Fake IT Worker Scheme

The Treasury Department sanctioned 10 North Korean and Russian individuals and entities on Wednesday for supporting a scheme in which North Korean operatives pose as legitimate IT professionals to get jobs at American and allied companies.

The action, announced by the Office of Foreign Assets Control, targets what Treasury describes as the machinery that turns fraudulent employment into revenue for Pyongyang. The workers use stolen identities and fake résumés to land jobs at unsuspecting firms, then send most of their pay back to the regime. The proceeds total hundreds of millions of dollars, according to CBS News' account of the announcement, and help fund North Korea's weapons of mass destruction and ballistic missile programs.

The scheme is dangerous beyond the money. Once inside a company's network, the workers can reach sensitive data, deploy malware and extort their employers.

Treasury named two individuals and one organization at the center of the action. Vitold Viktorovich Obertas, a Russian national, is described as an intermediary who has processed nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025. Kim Ki Hyok, a North Korean national, leads an IT worker delegation in Russia and monitors its personnel and financial targets. Treasury says he has moved nearly $500,000 in cryptocurrency for the delegation since 2024.

The organization is the First Financial and Technical Development Center, a Russia-based, North Korean-controlled group that procures IT workers for jobs in the United States and worldwide and runs cryptocurrency transfers. Six of its operatives were sanctioned along with it.

The sanctions block all property and interests in property of the designated people that are in the United States or in the possession of U.S. persons. Americans and U.S. residents are generally barred from doing business with them. Foreign banks and companies that deal with the designated parties can also face consequences.

Treasury framed the move as a step toward dismantling the system that funnels fraudulent employment income to North Korea's weapons programs. The Russian connection is notable. It shows the operation is not run only from North Korea or China, and that Russia-based facilitators handle cryptocurrency conversion and worker placement.

For employers, the practical message is about hiring. Remote IT jobs have been a favorite target because candidates can be screened by video and paid through intermediaries. Companies that unknowingly pay a sanctioned worker can face legal exposure on top of the security risk. The sanctions will not stop the scheme by themselves, since the workers use stolen and fabricated identities that are easy to replace, but they make it harder for the network to move money through Russian channels.