Treasury Sanctions North Korean, Russian Network Behind Fake IT Workers
On Wednesday, October 28, 2026, the Treasury's Office of Foreign Assets Control sanctioned 10 North Korean and Russian individuals and a Russian front company for placing fake IT workers into U.S. and allied firms.[1]
The network allegedly used stolen identities and bogus résumés to get North Korean IT operatives hired, then routed most of their wages back to Pyongyang.[1] Treasury named the First Financial and Technical Development Center and six operatives, blocking their U.S.-linked assets and barring most dealings with U.S. persons.[1] Russian national Vitold Viktorovich Obertas is accused of processing nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency for DPRK officials since January 2025.[1] North Korean national Kim Ki Hyok allegedly ran an IT worker delegation in Russia and transferred nearly $500,000 in cryptocurrency for the group since 2024.[1]
Vitold Viktorovich Obertas' alleged processing of nearly $2 million in crypto conversions and $1.25 million in other currency beginning in January 2025 illustrates how investigators say the network moved funds through Russia to benefit DPRK officials.[1] Kim Ki Hyok's transfers of nearly $500,000 in cryptocurrency since 2024 are said to have supported an IT worker delegation operating out of Russia.[1] Treasury said its designations block any U.S. assets and generally bar U.S. persons from dealing with the named company and individuals, a move meant to disrupt the payroll and conversion channels the network used.[1]
Show source details & analysis (1 source)
📌 Key Facts
- On Wednesday, October 28, 2026, Treasury's Office of Foreign Assets Control sanctioned 10 North Korean and Russian individuals and a Russia-based front company.
- The designated network allegedly places North Korean IT operatives in U.S. and allied firms using stolen identities and fake résumés, then routes most wages back to Pyongyang.
- Russian national Vitold Viktorovich Obertas is accused of processing nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency for DPRK officials since January 2025.
- North Korean national Kim Ki Hyok allegedly oversees an IT worker delegation in Russia and has transferred nearly $500,000 in cryptocurrency for the group since 2024.
- Treasury blacklisted the First Financial and Technical Development Center and six of its operatives, blocking their U.S.-linked assets and barring U.S. persons from most dealings.
📰 Source Timeline (1)
Follow how coverage of this story developed over time