Fake IT workers fund cyber activities, evading sanctions via illicit revenues
24 July 2025
The U.S. Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned Korea Sobaeksu Trading Company and three individuals Kim Se Un, Jo Kyong Hun, and Myong Chol Min for operating a clandestine IT worker network that generates revenue for North Korea’s nuclear and ballistic missile programs.
The DPRK uses front companies like Sobaeksu to deploy skilled IT workers globally, including to the U.S. and allied countries, using fake identities, stolen documents, and false personas to infiltrate legitimate businesses. Most of their earnings are confiscated by the DPRK government and funneled into weapons development. In some cases, these IT workers have also deployed malware to exfiltrate sensitive company data.
This multi-agency action involves the Departments of Treasury, Justice, State, and Homeland Security, as well as the FBI and Homeland Security Investigations. The U.S. Department of Justice also unsealed indictments against seven DPRK nationals for sanctions violations and counterfeit cigarette trafficking, while the State Department announced reward offers up to $7 million for leads on these individuals.
Entities and Individuals Sanctioned:
- Korea Sobaeksu Trading Company: A DPRK front company tied to the Munitions Industry Department, previously involved in deploying IT workers and nuclear procurement activities.
- Kim Se Un: A key Sobaeksu representative who coordinated overseas IT operations, including hiring developers in Vietnam.
- Jo Kyong Hun: A DPRK-based Sobaeksu IT team lead, involved in crypto-related financial operations.
- Myong Chol Min: A DPRK trade representative who facilitated sanctions evasion and imports like tobacco.
All are designated under Executive Orders 13382 or 13810, blocking any U.S.-controlled assets or dealings with them.
Sanctions Impact:
All property and interests of these individuals and entities within U.S. jurisdiction are frozen. U.S. persons and businesses are prohibited from engaging in transactions involving them, directly or indirectly. Violators may face civil or criminal penalties, including for providing goods, services, or funds to designated entities.
This move is part of an ongoing campaign to disrupt DPRK’s revenue generation mechanisms and apply pressure on the regime to end its illicit weapons programs.
Security isn’t optional. Upgrade today. Defend tomorrow.
praveen@finstein.ai | https://cyber.finstein.ai/
#CyberSanctions#CyberEspionage#DPRKHackers#NorthKoreaSanctions#SanctionsEnforcement#NationalSecurity#IllicitCyberActivity#ITWorkerAbuse#CyberThreatActors#MalwareDeployment
