Fighting Back: US Hits North Korean Hacker with Sanctions Over IT Worker Scheme

The U.S. Treasury Department on Tuesday imposed sanctions on a North Korean cyber operative accused of orchestrating a scheme that enables Pyongyang to exploit its overseas IT workforce for revenue generation, bolstering the regime’s defiant stance.

The department’s Office of Foreign Assets Control (OFAC) announced sanctions against Song Kum-hyok, identifying him as a malicious actor affiliated with the notorious Andariel hacking group, a branch of the sanctioned Reconnaissance General Bureau (RGB). The RGB is widely recognized as North Korea’s primary military intelligence agency.

According to the Treasury, Song facilitated a worker scheme that recruited individuals, predominantly North Korean nationals operating from countries such as China and Russia. These workers were provided with falsified identities and nationalities to secure employment at unsuspecting companies, funneling revenue back to the North Korean regime.

The department warned that in some cases, these North Korean IT operatives have been known to infiltrate company networks with malware, potentially opening doors for further exploitation.

OFAC also levied sanctions against one Russian national, two Russian entities, and two North Korean entities for their alleged involvement in the IT worker scheme.

“Today’s action underscores the critical need for vigilance against North Korea’s persistent efforts to covertly finance its WMD and ballistic missile programs,” stated Deputy Secretary of the Treasury Michael Faulkender. WMD refers to weapons of mass destruction.

“The Treasury remains resolute in employing all available tools to disrupt the Kim regime’s attempts to circumvent sanctions through digital asset theft, impersonation of U.S. citizens, and malicious cyber operations,” Faulkender added.

The department emphasized that these sanctions align with the U.S. government’s broader strategy to counter North Korea’s efforts to advance its strategic objectives through cyber espionage and illicit revenue generation. (Yonhap)