US Treasury Sanctions North Korean and Russian Firms for Assisting North Korean IT Workers' Fraudulent Employment

Sanctions Imposed on Song Kumhyok
Linked to North Korean Hacking Group Andariel

On July 8 (local time), the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) announced sanctions against Song Kumhyok, a malicious cyber actor linked to Andariel, a hacking group associated with North Korea's Reconnaissance General Bureau.

The Treasury Department explained that Song Kumhyok assisted in a scheme in which North Korean nationals, primarily operating in countries such as China and Russia, disguised their identities and nationalities to gain employment at information technology (IT) companies. This scheme was designed to help the North Korean regime secure funds necessary for the development of weapons of mass destruction (WMD) and ballistic missiles.

It was reported that these North Korean IT workers, who were employed under false pretenses, planted malicious software in company networks to steal funds.

The Treasury Department also included in the sanctions list a Russian national who assisted in carrying out this scheme in Russia, two Russian companies operated by this individual, and two North Korean trading companies that dispatched IT workers to Russia. Those subject to U.S. sanctions will have all assets in the United States frozen, and will be prohibited from traveling to the United States or conducting transactions with U.S. persons.