Threat intel
New DPRK IT worker sanctions: your payroll is in scope
OFAC sanctioned 10 people and one Russia-based entity behind North Korean IT worker schemes on October 28. What it means for employers who pay remote staff.
On October 28 the US Treasury's Office of Foreign Assets Control (OFAC) sanctioned 10 individuals and one entity for running or financing North Korean IT worker schemes. They include two Russian cryptocurrency handlers and six IT workers for the First Financial and Technical Development Center (FFTDC), a North Korea controlled outfit in Russia that was itself designated. Treasury says these schemes generate hundreds of millions of dollars for North Korea's weapons programs, and that the state takes most of each worker's wages.
For a company that hires remote developers or contractors, the sanctions change the question from "were we defrauded" to "did we pay a sanctioned network". OFAC can impose civil penalties on a strict liability basis, which means a US company can be liable even if it had no idea who it was paying. The workers apply under stolen or fabricated identities, not the names on the sanctions list, so the controls that matter sit in hiring, payroll and endpoint data, not in a name-screening tool.
Who was designated and what Treasury says they did
Two of the networks sit under Chinyong Information Technology Cooperation Company (designated May 2023) and its subordinate Alis (designated March 2024). Kim Ki Hyok runs a Russia-based Alis delegation and makes sure its workers hit their earnings targets; he has moved nearly $500,000 in cryptocurrency for it since 2024. Kim Hyo Dong leads a separate Chinyong delegation, handling logistics and sanctions evasion and moving over $100,000 in assets since at least December 2023. Russian national Ilya Boykov converts and monitors cryptocurrency for Alis: the equivalent of $3.5 million since 2024.
Vitold Obertas, also Russian, moves money for North Korean officials, including for Amnokgang Technology Development Company, designated on March 12, 2026. Since January 2025 he has made nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions. The Record reports $3.5 million for Obertas and ties Boykov to Amnokgang; we use Treasury's figures.
The third network is FFTDC, designated for exporting North Korean workers to earn revenue for the state. It has made several million dollars, and six of its Russia-based workers (Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan and Hyon Se Il) generated over $750,000 since 2025. Its workers use what Treasury calls "Super Intelligence (SI) tools", and The Record reports that FFTDC helps them use AI to get hired. Australia and the European Union made related designations this month.
Why paying one is a sanctions problem
A designation blocks all property and interests in property of the listed person that is in the US or held by a US person, and it must be reported to OFAC. Companies 50 percent or more owned by blocked persons are blocked too. US persons are generally barred from any transaction involving that property, including providing funds or services to a blocked person. A paycheck to a worker whose wages flow to FFTDC or Alis fits that description, even when it lands in a US bank account in a stolen name.
The 2022 joint advisory from the State Department, Treasury and the FBI sets out the exposure. Civil penalties under the North Korea Sanctions Regulations (31 CFR part 510) can reach the greater of the statutory maximum or twice the value of the transaction. Willful violations of the International Emergency Economic Powers Act (IEEPA) carry up to 20 years in prison and fines of up to $1 million. OFAC weighs cooperation and self-disclosure under its Economic Sanctions Enforcement Guidelines, so finding a worker early and reporting it counts in a company's favour.
What the workers do once inside
Beyond the wages, Treasury says workers have deployed malware, exfiltrated data and stolen proprietary information. The FBI's January 2025 public service announcement (PSA) adds detail: after discovery, workers have held stolen code and data hostage for ransom and in some cases published a victim's proprietary code. They copy repositories to personal accounts and cloud storage, and harvest credentials and session cookies so they can keep working from devices the company does not control. The 2022 advisory describes one US company that lost over $50,000 in 30 small charges to its payment account over several months, each too small to notice.
What to do
Our earlier post on laptop farms covers shipping and endpoint checks such as remote-access tools and KVM-over-IP devices. The steps below focus on hiring, payments and the response.
In interviews and verification
- Cross-check your applicant tracking system for other candidates with the same resume text, phone number or email address. The FBI notes reused VoIP numbers in particular.
- Ask "soft" questions about where the candidate lives and studied, and compare the answers with their stated time zone and the hours they are actually online.
- Verify past employers and universities using contact details you find yourself, not the ones on the resume or profile.
- Keep identity checks going after the hire. The FBI asks for verification during interviewing, onboarding and throughout employment, and to do as much of it in person as you can.
- Audit staffing firms that supply remote contractors: ask how they verify identity and check it yourself on a sample.
In payroll and accounts payable
Treat any of these as a reason to re-verify the person on a live video call with their ID:
- a change of bank account or payment platform during onboarding, or an account in a different name from the employee's;
- a request to be paid in cryptocurrency, or through PRC-linked payment services;
- a contractor's platform or payment account being shut down, followed by a request to use another one;
- requests for payment without meeting milestones or attending check-ins;
- small, repeated charges on company cards or payment accounts that nobody approved.
On the network
From the FBI PSA: look for many logins to one account from IP addresses in different countries within a short period, software that runs several audio or video calls at once on a company laptop, and pushes or uploads from company repositories to personal GitHub accounts or cloud drives. Least privilege limits the damage: no local admin rights, and no remote desktop tools the job does not need.
If you find one
- Revoke sessions, tokens, VPN and repository access before the person learns they are under suspicion. Former workers have turned to extortion.
- Preserve the evidence: endpoint and identity logs, repository audit logs, and the device. The FBI asks companies to capture activity on the suspect's devices.
- Freeze pending payments to the worker and to any staffing firm involved, and bring in sanctions counsel on whether funds must be blocked and reported to OFAC and whether to self-disclose.
- Report to the FBI at ic3.gov as quickly as possible, with names used, email addresses, phone numbers, bank and crypto accounts and IP addresses.
- Rotate every secret the account could reach: API keys, cloud credentials, CI tokens and shared passwords, and review its commits for anything planted.
The wider lesson
Sanctions screening on new hires will come back clean, because the personas are not on any list. The red flags are spread across recruiting, payroll and security tooling, and each team sees only its part. Give one person the job of putting those records side by side for every remote hire in their first weeks.
Our compliance and audit readiness work helps put sanctions and hiring controls in writing with an owner for each, and our security operations team builds the detections that tie login, repository and payroll signals together. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.
Sources: US Treasury press release, October 28, 2026, The Record, FBI IC3 PSA250123, State, Treasury and FBI guidance on DPRK IT workers (May 2022).