US targets North Korean IT worker army with new sanctions

The U.S. Treasury’s Office of Foreign Assets Control sanctioned two individuals and two companies connected with North Korean IT worker schemes that exploit skilled staff in U.S. firms and use “laptop farms” to hide their true location, with the ultimate aim of funding the DPRK regime’s weapons programme.

The designated are Vitaliy Sergeyevich Andreyev, a Russian national who has worked with DPRK officials since at least December 2024 to facilitate financial transfers for the Chinyong Information Technology Cooperation Company; Kim Ung Sun, a DPRK economic and trade consular official based in Russia who helped channel funds for the sanctioned IT worker network; Shenyang

Geumpungri Network Technology Co., Ltd, a Chinese front company tied to Chinyong comprising a DPRK IT worker delegation; and Korea Sinjin Trading Corporation, a DPRK company already under U.S. sanctions that receives directives from DPRK officials regarding overseas IT workers and benefits from their earnings. According to Chainalysis, Andreyev’s Bitcoin wallet was used as a deposit address on a mainstream exchange to launder proceeds from the DPRK IT workers.

The sanctions include freezing U.S.-based assets and prohibiting American citizens and businesses from engaging in any transactions with the designated entities, and they extend beyond the U.S. as entities risk secondary sanctions for transactions on behalf of the designated persons and companies. Last July, U.S. authorities sanctioned, charged, or indicted a total of 20 individuals and eight companies in three separate waves of enforcement. 28 August 2025.