美国财政部制裁朝鲜 IT 工人欺诈行为的协助者

美国财政部制裁朝鲜 IT 员工欺诈的协助者美国财政部
一把锁 ( )
新闻稿
美国财政部制裁朝鲜 IT 工人欺诈行为的协助者
2026 年 10 月 28 日
华盛顿——今天，美国财政部外国资产控制办公室 (OFAC) 对 10 名个人和 1 个实体实施了制裁，因为他们参与了朝鲜民主主义人民共和国 (DPRK) 政府运营的信息技术 (IT) 工人计划，这些计划诈骗美国企业并为朝鲜非法大规模杀伤性武器 (WMD) 和弹道导弹计划创收。
美国财政部长斯科特·贝森特 (Scott Bessent) 表示：“朝鲜政权继续通过其海外 IT 人员进行的欺诈活动来瞄准和利用美国公司，他们将敏感数据武器化，并勒索企业巨额付款。” “在特朗普总统的领导下，财政部将继续使用一切可用的工具来保护美国企业免受这些恶意活动的影响，并追究责任人的责任。”
朝鲜继续依靠欺诈性文件、被盗身份和捏造人物来隐藏其 IT 员工并确保在合法公司（包括美国及其盟国的公司）就业。朝鲜政权随后挪用了这些工人的大部分工资，赚取数亿美元来资助其非法大规模杀伤性武器和弹道导弹计划。今天的行动针对的是帮助维持这些计划并代表朝鲜转移非法收益的关键推动者和金融网络。这些网络利用复杂的加密货币交易、洗钱技术和新兴技术（包括人工智能工具）为朝鲜政府生成和转移数百万美元。除了创收之外，朝鲜 IT 员工还利用对企业网络的访问来部署恶意软件、泄露敏感数据并窃取专有信息，给全球企业带来重大风险。
今天的行动建立在 OFAC 于 2026 年 3 月 12 日指定一个单独的朝鲜 IT 工人网络的基础上，并表明了财政部对拆除为朝鲜产生非法收入的网络的持续承诺。这些网络渗透到全球金融体系，需要采取统一的应对措施来应对威胁。本月，澳大利亚和欧盟与美国一起指定了支持朝鲜创收和军事活动的个人和实体。财政部将继续与多边制裁监测小组 (MSMT) 参与国和其他国际合作伙伴密切合作，采取这些行动。美国将与盟友和伙伴合作，继续揭露和破坏那些使朝鲜能够逃避制裁并资助其非法武器计划的行为。
有关朝鲜 IT 员工使用的策略以及保护专用网络可采取的步骤的更多信息，请参阅国务院、财政部和司法部发布的有关朝鲜 IT 员工的咨询和警报；联邦调查局；以及多边执法联盟。
全球朝鲜 IT 工作者网络的关键推动者
OFAC 今天的行动针对多个朝鲜 IT 员工网络，指定驻扎在朝鲜和俄罗斯的协调员和朝鲜 IT 员工。
Vitold Viktorovich Obertas (Obertas) 是一名俄罗斯中间人，从事非法朝鲜金融交易，其中包括鸭绿江技术开发公司 (Amnokgang)。 OFAC 在 2026 年 3 月 12 日的行动中指定了鸭绿江。自 2025 年 1 月以来，Obertas 已为朝鲜官员进行了价值近 200 万美元的加密货币兑换，以及至少 125 万美元的其他货币交易。 OFAC 根据第 13687 号行政命令 (E.O.) 指定 Obertas 为朝鲜政府提供实质性协助、赞助或提供财务、物质或技术支持，或者向朝鲜政府提供商品或服务。
朝鲜国家有限责任公司 Alis (Alis) 负责人 Kim Ki Hyok 率领驻俄罗斯的朝鲜 IT 员工代表团，其主要职责包括监督 Alis IT 员工并确保他们实现财务目标。 OFAC 于 2024 年 3 月指定 Alis 隶属于 Chinyong 信息技术合作公司 (Chinyong)，OFAC 于 2023 年 5 月指定该公司。自 2024 年以来，Kim Ki Hyok 已为代表团转移了价值近 50 万美元的加密货币。此外，朝鲜国民金孝东率领另一个驻俄罗斯的钦永下属代表团。至少自 2023 年 12 月起，Kim Hyo Dong 一直为 IT 工人代表团提供后勤援助，参与逃避制裁的活动，并协助转移超过 10 万美元等值的金融资产。 OFAC 根据 E.O. 指定 Kim Ki Hyok 和 Kim Hyo Dong 13687 为 Chinyong 提供物质协助、赞助或提供财务、物质或技术支持，或商品或服务或支持 Chinyong。
自2024年以来，俄罗斯国民伊利亚·亚历山德罗维奇·博伊科夫（Boykov）积极支持阿里斯，通过兑换和兑换等值350万美元的加密货币交易、监控加密货币交易以及为阿里斯提供后勤支持。 OFAC 根据 E.O. 指定 Boykov 13687 为 Alis 提供物质协助、赞助或提供财务、物质或技术支持，或商品或服务或支持 Alis。
至少自 2024 年起，**第一金融和技术开发中心 (**FFTDC) 是位于俄罗斯的朝鲜控制实体，使用朝鲜 IT 工人，这些工人代表朝鲜政府赚取了数百万美元。 FFTDC 已向俄罗斯部署了几名训练有素的朝鲜 IT 工作人员，他们使用超级情报 (SI) 工具并使用复杂的洗钱方法（包括复杂的加密货币转移）来促进其创收计划。自 2025 年以来，居住在俄罗斯的朝鲜 IT 工人 Kim Kyong Ju、Ri Thae Chol、So Hyon Jin、Han Yu Song、Kim Sung Gwan 和 Hyon Se Il 代表 FFTDC 总共赚取了超过 75 万美元。
OFAC 正在根据 E.O. 指定 FFTDC。 13722 从事、促进或负责从朝鲜输出工人，包括为朝鲜政府或朝鲜劳动党创收而进行的输出。此外，OFAC 根据 E.O. 指定 Kim Kyong Ju、Ri Thae Chol、So Hyon Jin、Han Yu Song、Kim Sung Gwan 和 Hyon Se Il。 13722 为 FFTDC 提供物质协助、赞助或提供财务、物质或技术支持，或商品或服务或支持 FFTDC。
制裁的影响
由于今天的行动，上述被指定或被阻止的人员在美国境内或由美国人拥有或控制的所有财产和财产权益均被冻结，并且必须向 OFAC 报告。此外，由一名或多名被封锁人员直接或间接、单独或合计拥有 50% 或以上股份的任何实体也将被封锁。除非获得 OFAC 颁发的一般或特定许可证授权或豁免，否则 OFAC 的法规通常禁止美国人或在美国境内（或过境）进行所有涉及被封锁人员的任何财产或财产权益的交易。
违反美国制裁可能会导致美国和外国人受到民事或刑事处罚。非美国还禁止任何人导致或密谋导致美国人有意或无意违反美国制裁，以及从事逃避美国制裁的行为。 OFAC 可以在严格责任的基础上对违反制裁行为处以民事处罚。 OFAC 的经济制裁
[正文过长，已截取前部进行翻译]

Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses | U.S. Department of the Treasury
A lock ( )
Press Releases
Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses
October 28, 2026
WASHINGTON —Today, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned 10 individuals and one entity for their roles in Democratic People’s Republic of Korea (DPRK) government-run information technology (IT) worker schemes that defraud U.S. businesses and generate revenue for the DPRK’s unlawful weapons of mass destruction (WMD) and ballistic missile programs.
“The North Korean regime continues targeting and exploiting American companies through fraudulent activities conducted by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments,” said S ecretary of the Treasury Scott Bessent . “Under President Trump’s leadership, Treasury will continue to use all available tools to protect U.S. businesses from these malicious activities and hold those responsible accountable.”
The DPRK continues to rely on fraudulent documents, stolen identities, and fabricated personas to conceal its IT workers and secure employment with legitimate companies, including those in the United States and allied countries. The DPRK regime then appropriates most of these workers’ wages, generating hundreds of millions of dollars to fund its unlawful WMD and ballistic missile programs. Today’s action targets key facilitators and financial networks that help sustain these schemes and move illicit proceeds on behalf of the DPRK. These networks have leveraged sophisticated cryptocurrency transactions, money laundering techniques, and emerging technologies, including artificial intelligence tools, to generate and transfer millions of dollars for the DPRK government. In addition to generating revenue, DPRK IT workers have exploited their access to corporate networks to deploy malware, exfiltrate sensitive data, and steal proprietary information, creating significant risks for businesses worldwide.
Today’s action builds on OFAC’s March 12, 2026 designation of a separate DPRK IT worker network and demonstrates Treasury’s sustained commitment to dismantling the networks that generate illicit revenue for the DPRK. These networks permeate through the global financial system, necessitating a unified response to match the threat. The United States is joined this month by Australia and the European Union in designating individuals and entities supporting the DPRK’s revenue generation and military activities. Treasury continues to take these actions in close partnership with the Multilateral Sanctions Monitoring Team (MSMT) Participating States and other international partners. Working with allies and partners, the United States will continue to expose and disrupt those enabling the DPRK to evade sanctions and finance its unlawful weapons programs.
More information about the tactics utilized by DPRK IT workers and steps that can be taken to protect private networks can be found in advisories and alerts regarding DPRK IT workers issued by the Departments of State, Treasury, and Justice ; the FBI ; and a multilateral consortium of law enforcement .
KEY ENABLERS OF GLOBAL DPRK IT WORKER NETWORKS
OFAC’s action today targets several DPRK IT worker networks by designating facilitators and DPRK IT workers based in the DPRK and Russia.
Vitold Viktorovich Obertas (Obertas) is a Russian intermediary for illicit DPRK financial transactions, including for Amnokgang Technology Development Company (Amnokgang). OFAC designated Amnokgang in its March 12, 2026 action. Since January 2025, Obertas has conducted nearly $2 million worth of cryptocurrency conversions, as well as at least $1.25 million in other currency transactions, for DPRK officials. OFAC is designating Obertas pursuant to Executive Order (E.O.) 13687 for having materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of, the Government of North Korea.
DPRK-national Limited Liability Company Alis (Alis) lead Kim Ki Hyok leads a Russia-based delegation of DPRK IT workers, whose primary duties include monitoring Alis IT workers and ensuring they meet their financial targets. OFAC designated Alis in March 2024 for being subordinate to the Chinyong Information Technology Cooperation Company (Chinyong), which OFAC designated in May 2023. Since 2024, Kim Ki Hyok has transferred cryptocurrency for the delegation valued at nearly $500,000. Additionally, DPRK national Kim Hyo Dong leads a separate Russia-based Chinyong-subordinate delegation. Since at least December 2023 Kim Hyo Dong has provided logistical assistance to the IT worker delegation, engaged in sanctions evasion efforts, and facilitated the transfer of over $100,000 equivalent in financial assets. OFAC is designating Kim Ki Hyok and Kim Hyo Dong pursuant to E.O. 13687 for having materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of, Chinyong.
Since 2024, Russian national Ilya Aleksandrovich Boykov (Boykov) has actively supported Alis by exchanging and converting an equivalent of $3.5 million in cryptocurrency transactions, monitoring cryptocurrency transactions, and providing logistical support for Alis. OFAC is designating Boykov pursuant to E.O. 13687 for having materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of, Alis.
Since at least 2024, the **First Financial and Technical Development Center (**FFTDC) is a DPRK-controlled entity located in Russia that uses DPRK IT workers who have generated several millions of dollars on behalf of the DPRK government. The FFTDC has deployed several highly trained DPRK IT workers to Russia who employ Super Intelligence (SI) tools and use sophisticated money laundering methods, including complex cryptocurrency transfers, to facilitate their revenue generation schemes. Since 2025, Russia-based DPRK IT workers Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan, and Hyon Se Il have collectively generated over $750,000 on behalf of the FFTDC.
OFAC is designating FFTDC pursuant to E.O. 13722 for having engaged in, facilitated, or been responsible for the exportation of workers from North Korea, including exportation to generate revenue for the Government of North Korea or the Workers’ Party of Korea. Additionally, OFAC is designating Kim Kyong Ju, Ri Thae Chol, So Hyon Jin, Han Yu Song, Kim Sung Gwan, and Hyon Se Il pursuant to E.O. 13722 for having materially assisted, sponsored, or provided financial, material, or technological support for, or goods or services to or in support of, FFTDC.
SANCTIONS IMPLICATIONS
As a result of today’s action, all property and interests in property of the designated or blocked persons described above that are in the United States or in the possession or control of U.S. persons are blocked and must be reported to OFAC. In addition, any entities that are owned, directly or indirectly, individually or in the aggregate, 50 percent or more by one or more blocked persons are also blocked. Unless authorized by a general or specific license issued by OFAC, or exempt, OFAC’s regulations generally prohibit all transactions by U.S. persons or within (or transiting) the United States that involve any property or interests in property of blocked persons.
Violations of U.S. sanctions may result in the imposition of civil or criminal penalties on U.S. and foreign persons. Non-U.S. persons are also prohibited from causing or conspiring to cause U.S. persons to wittingly or unwittingly violate U.S. sanctions, as well as engaging in conduct that evades U.S. sanctions. OFAC may impose civil penalties for sanctions violations on a strict liability basis. OFAC’s Economic Sanctions Enforcement Guidelines provide more information regarding OFAC’s enforcement of U.S. economic sanctions. In addition, financial institutions and other persons may risk exposure to sanctions for engaging in certain transactions or activities involving designated or otherwise blocked persons. The prohibitions include the making of any contribution or provision of funds, goods, or services by, to, or for the benefit of any designated or blocked person, or the receipt of any contribution or provision of funds, goods, or services from any such person.
The power and integrity of OFAC sanctions derive not only from OFAC’s ability to designate and add persons to the Specially Designated Nationals and Blocked Persons List (SDN List), but also from its willingness to remove persons from the SDN List consistent with the law. The ultimate goal of sanctions is not to punish, but to bring about a positive change in behavior. For information concerning the process for seeking removal from an OFAC list, including the SDN List, or to submit a request, please refer to OFAC’s guidance on Filing a Petition for Removal from an OFAC List .
Click here for more information on the persons designated today.
###