Involved in Data Theft and Ransomware Attacks Targeting US Companies
The US Treasury''s Office of Foreign Assets Control (OFAC) announced on August 27, 2025 additional sanctions against Russian, Chinese, and North Korean individuals and institutions linked to North Korea''s overseas IT worker fraud network. Sanctioned entities include Russian national Vitaly Sergeyevich Andreyev; North Korean economic and trade consul in Russia Kim Woong-sun; Shenyang Geumpungri Network Technology (China); and Sinchon Trading Company (North Korea).
Treasury stated these entities generated millions in revenue through North Korea''s government-organized overseas IT worker network, diverting proceeds to fund weapons of mass destruction (WMD) and ballistic missile programs. North Korea dispatches thousands of IT personnel overseas, employing them at US and allied companies using disguised identities and stolen credentials — committing data theft and ransomware attacks against US companies while the regime recovers most earnings for weapons development.
Specific sanctioned entities: Andreyev (Russian national, laundered 60万+ in cryptocurrency for North Korean IT company Chinyong); Kim Woong-sun (North Korean trade consul in Russia); Shenyang Geumpungri (North Korean IT personnel front company, transferred $1M+ to North Korea since 2021); Sinchon Trading Company (under North Korean People''s Armed Forces General Political Bureau, directly executing IT personnel operations). Sanction effects: full asset freezing within the US or under US person ownership/control; US companies and financial institutions prohibited from all transactions with sanctioned parties (civil and criminal sanctions for violations); foreign financial institutions transacting with sanctioned entities face secondary sanction risks.
This action was announced jointly with diplomatic statements from Japan and South Korea — demonstrating intent to block the North Korean IT worker problem through international community coordination rather than US action alone. North Korea reportedly earns hundreds of millions annually through overseas IT workers, supporting nuclear and missile development. With these networks operating from China and Russia bases, international cooperation is essential for maximum effectiveness. This sanction will prompt global private companies to become more vigilant about North Korean IT personnel recruitment issues.
