Trump administration sanctions North Korean IT worker network

The Trump administration imposed new sanctions on Wednesday, October 28, 2026, targeting a North Korean government-run scheme accused of infiltrating U.S. companies. According to the Treasury Department's Office of Foreign Assets Control (OFAC), the scheme uses fraudulent identities to place IT workers inside legitimate U.S. companies to funnel earnings toward North Korea's weapons of mass destruction and ballistic missile programs.

Allegations of employment fraud and data theft

The Treasury Department alleges that North Korean workers used stolen identities, fraudulent documents, and fake personas to secure legitimate technology jobs in the U.S. and allied countries. Once employed, the regime allegedly collected most of their wages, generating hundreds of millions of dollars.

According to the Treasury, these workers have also:

• Deployed malware
• Stolen sensitive data and proprietary information
• Extorted companies for substantial payments

"The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments," Treasury Secretary Scott Bessent said in a statement.

Sanctioned individuals and entities

The sanctions target ten individuals and one entity. The Treasury Department identified the First Financial and Technical Development Center, a North Korean-controlled entity located in Russia, as a key part of the operation. The Treasury stated the center deployed highly trained North Korean IT workers who allegedly employed "Super Intelligence (SI) tools" and sophisticated money-laundering methods, including complex cryptocurrency transfers.

Specific individuals named in the sanctions include:

• Vitold Viktorovich Obertas: A Russian intermediary accused of handling nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions for North Korean officials since January 2025.
• Ilya Aleksandrovich Boykov: A Russian national accused of facilitating cryptocurrency transactions worth the equivalent of $3.5 million since 2024 for a previously sanctioned North Korean entity.
• Kim Ki Hyok: A North Korean national whom the Treasury says leads an IT worker delegation in Russia and has transferred nearly $500,000 in cryptocurrency on behalf of the delegation since 2024.

Regulatory impact

The sanctions block property and interests in property belonging to the designated individuals and the entity that are in the U.S. or in the possession or control of U.S. persons. The measures generally prohibit U.S. persons from conducting transactions involving these parties unless authorized by OFAC. This action follows separate sanctions imposed against another North Korean IT-worker network in March.

---

Sources

• foxbusiness.com: North Korea sanctions target IT worker scheme funding weapons programs | Fox Business
• demokratis.co.id: Treasury Sanctions North Korean IT Fraud Network
• news.ssbcrack.com: Trump Administration Imposes New Sanctions on North Korean IT Worker Fraud Scheme - SSBCrack News

This article was drafted with AI assistance and checked against the sources above. Company claims are reported as claims. Cover image is AI-generated.