Sanctions to Disrupt DPRK IT Worker Schemes Defrauding U.S. Businesses

Today, the United States sanctioned two entities and six individuals involved in operations using Information Technology (IT) workers in foreign countries to generate revenue for the Democratic People’s Republic of Korea’s (DPRK) government.  These government-orchestrated schemes systematically defraud U.S. businesses and direct the illicit proceeds toward the DPRK’s weapons of mass destruction (WMD) and ballistic missile programs. DPRK-facilitated IT teams commonly use fraudulent documentation, stolen identities, and fabricated personas to conceal their true identities and gain employment with legitimate companies worldwide.   

As described in the October 22, 2025, report of the Multilateral Sanctions Monitoring Team, “The DPRK’s Violation and Evasion of UN Sanctions Through Cyber and Information Technology Worker Activities,”revenue derived from the DPRK’s cryptocurrency heists and overseas IT worker operations funds its unlawful WMD and ballistic missile programs.  This illicit revenue generation threatens American citizens, international security, and the global digital economy.   

The United States strongly condemns all activities of DPRK-associated entities that support the DPRK’s weapons programs in violation of UN and U.S. sanctions.  Today’s action holds accountable those who target U.S. persons and support the DPRK’s illegal weapons programs. We stand committed together with other MSMT members to strengthen our resilience against such threats. 

The Department of the Treasury’s action was taken pursuant to Executive Orders 13810 and 13382.  For more information on today’s action, please see the Department of the Treasury’s press releases.