Treasury Sanctions 10 People and One Entity Tied to North Korean IT Worker Schemes, Many Based in Russia

What happened

On October 28, the Office of Foreign Assets Control (OFAC) sanctioned 10 individuals and one entity it links to North Korean government-run IT worker schemes ^[1]. Treasury says those schemes defraud U.S. businesses and raise money for North Korea's weapons of mass destruction and ballistic missile programs ^[1]. The SDN List update shows two Russian nationals, Ilya Aleksandrovich Boykov, as well as Vitold Viktorovich Obertas, alongside eight North Korean nationals listed with addresses in Russia ^[2].

Treasury says Obertas has carried out nearly $2 million worth of cryptocurrency conversions for North Korean officials since January 2025, and that Boykov converted an equivalent of $3.5 million in cryptocurrency for Alis, an IT worker company ^[1]. It says six workers tied to the First Financial and Technical Development Center, which it calls a DPRK-controlled entity located in Russia, generated over $750,000 for it since 2025 ^[1]. The listing gives digital currency addresses (ETH, and in two cases TRX) for Boykov, for Obertas, and for Kim Ki Hyok ^[2].

The same listing adds two Rwandan entities under the Democratic Republic of the Congo program: the RWANDAN MINISTRY OF DEFENCE, plus ZIGAMA CREDIT AND SAVINGS SOCIETY ^[2].

How it affects Americans

Any property of the listed people in the United States, or held by U.S. persons, is now blocked, and Americans are generally barred from dealing with them ^[1]. Each of the North Korea entries also carries "Secondary sanctions risk" and "Transactions Prohibited For Persons Owned or Controlled By U.S. Financial Institutions: North Korea Sanctions Regulations section 510.214" ^[2]. Treasury says North Korea uses stolen identities and fake personas to get its IT workers hired, including by companies in the United States ^[1].

The Veil Press view

Firms that hire remote contractors are the most exposed here, since Treasury says these workers have also used their network access to plant malware and steal data ^[1]. "The North Korean regime continues targeting and exploiting American companies," Bessent said ^[1]. The allegations are Treasury's; none of those named has been charged in court in the records cited here ^[1][2].

What we know

Confirmed

• OFAC added 10 individuals and the First Financial and Technical Development Center to the SDN List on October 28 ^[1][2].
• Two of the individuals are Russian nationals; eight are North Korean nationals listed in Russia ^[2].
• Rwanda's defence ministry and ZIGAMA CREDIT AND SAVINGS SOCIETY were added under DRC-related sanctions ^[2].

Still being reported

• Treasury's dollar figures for the cryptocurrency transfers and worker revenue have not been independently verified ^[1].
• Treasury says Australia and the European Union also designated people supporting North Korea's revenue generation this month ^[1].