Washington DC has imposed sanctions on North Korean entities engaged in training expat IT workers for money laundering and malicious cyber activities in Laos, China, and Russia on 23 May.
The US Treasury’s Office of Foreign Assets Control (OFAC), along with South Korea’s Ministry of Foreign Affairs (MOFA), announced the sanctions targeting a total of six entities and seven individuals.
Among the sanctioned entities are the Pyongyang University of Automation, the Technical Reconnaissance Bureau, its subordinate cyber unit, and the 110th Research Center. These entities are believed to be affiliated with North Korea’s primary intelligence service, the Reconnaissance General Bureau (RGB).
According to the treasury department, the DPRK-based Technical Reconnaissance Bureau leads the development of offensive cyber tactics and tools for North Korea. It operates multiple departments, including those associated with the Lazarus Group, a cybercrime group made up of numerous anonymous individuals run by the government of North Korea.
The fourth entity facing sanctions is the Jinyong Information Technology Cooperation Company, also known as Chinyong IT Cooperation Company. This company has been involved in the illegal employment of IT workers who fraudulently obtain jobs in Russia and Laos. They generate revenue, including virtual currency, to support North Korea’s illegal weapons of mass destruction and ballistic missile programs.
The individual sanctioned in this action is Kim Sang Nam, a representative of the Chinyong Office located in Vladivostok, Russia. He has also been sanctioned by the South Korean government. Kim is suspected of being involved in the sale and transfer of IT equipment for the North Korean regime. Between 2021 and 2022, he received cryptocurrency fund transfers valued at over USD 28 million from IT teams based in China and Russia.
The OFAC has identified six cryptocurrency addresses associated with Kim, all of which are deposit addresses at a major mainstream exchange. Some of these addresses are related to Ethereum transactions involving Tether and USDC ERC-20 tokens.
The proceeds from these illicit activities are believed to be sent back to North Korea to support its weapons development programs.
Additionally, South Korea’s Ministry of Foreign Affairs (MOFA) has also imposed sanctions on three entities and seven individuals believed to represent the North Korean regime. One of the entities, Tongmyong Technology Trade Company, is reported to be operating in Laos, with Jon Yon Gon and Kim Hyo Dong acting as representatives of the company.
The department has warned that these workers often conceal their true identities, locations, and nationalities by assuming false pretenses and forging documents to secure employment. They have been found working in various industries, including business, health and fitness, social networking, sports, entertainment, and lifestyle.
