U.S. Treasury Sanctions DPRK IT-Worker Scheme, Exposing $600K Crypto Transfers and $1M+ Profits

The U.S. Treasury’s Office of Foreign Assets Control (OFAC) announced a fresh round of sanctions against two individuals and two entities connected to North Korea’s remote IT worker scheme, which allegedly generates illicit revenue for DPRK weapons and missile programmes. The sanctioned include Vitaliy Sergeyevich Andreyev, Kim Ung Sun, Shenyang Geumpungri Network Technology Co., Ltd, and Korea Sinjin Trading Corporation, with Chinyong Information Technology Cooperation Company noted as an earlier sanction target.

The Treasury says the operation embeds DPRK IT workers in Western companies, using fraudulent documents and false personas to secure employment and extort data, with some cases involving malware delivery to exfiltrate information. Andreyev, a 44-year-old Russian national, has facilitated payments to Chinyong and worked with Kim Ung Sun to conduct multiple transfers worth nearly $600,000 since December 2024.

Shenyang Geumpungri is described as a Chinese front for Chinyong, generating over $1 million in profits for Chinyong and Sinjin since 2021, according to Under Secretary of the Treasury for Terrorism and Financial Intelligence John K. Hurley.