The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has announced the imposition of sanctions against Song Kum Hyok (Song), a prominent cyber operator tied to the Democratic People’s Republic of Korea (DPRK) Reconnaissance General Bureau (RGB), and several entities implicated in facilitating the regime’s global information technology (IT) worker operation.
The action targets not only Song but also a Russia-based network led by Gayk Asatryan, which has contracted DPRK nationals as part of North Korea’s ongoing efforts to covertly fund its weapons of mass destruction and ballistic missile programs through cyber-enabled means.
Sanctions Target Malicious Cyber Networks
Song Kum Hyok is identified as a key facilitator, orchestrating schemes that leveraged falsified identities and documentation to embed DPRK IT workers within international companies, with a significant focus on U.S. firms.
These workers, often based in Russia and China, secure employment using stolen identities and forged credentials, generating both direct financial revenue and enabling potential malware infiltration for additional exploitation.
OFAC’s move comes as part of a broader U.S. government strategy to counter cyber-enabled revenue streams supporting the Kim regime’s strategic ambitions, building on previous United Nations Security Council (UNSC) and U.S. designations against DPRK state-sponsored hacking collectives such as Lazarus Group, Bluenoroff, and Andariel, all subordinate to the RGB.
Investigations reveal that Song, during 2022 and 2023, utilized the personally identifiable information of U.S. citizens including Social Security numbers and addresses to create aliases for North Korean operatives seeking remote work in the U.S.
The income generated from these foreign-hired IT workers was shared between Song and the operatives, funneling illicit revenue back to the sanctioned regime in Pyongyang.
Expanding Focus
The actions also extend to the “Asatryan IT Worker Network,” with Russia-based national Gayk Asatryan and his associated entities Asatryan LLC and Fortuna LLC entering long-term contracts with North Korean companies to hire dozens of DPRK IT workers over the next decade.
These arrangements explicitly contravene international sanctions by exporting North Korean labor to generate state revenue.
In addition, North Korean entities Songkwang Trading and Saenal Trading are designated for their roles in facilitating these labor exports and commercial partnerships that support DPRK government funding streams.
With these designations, any property or interests in property tied to the sanctioned individuals and entities within the United States or controlled by U.S. persons are now blocked and must be reported to OFAC.
The prohibitions extend to any entities owned 50 percent or more by designated persons. U.S. persons, and those transacting within or transiting through the United States, are now generally barred from engaging in any activity involving blocked property or provision of funds, goods, or services to or from designated entities unless specifically authorized by OFAC.
Violations of these sanctions expose both U.S. and foreign individuals and institutions to substantial civil or criminal penalties, enforced on a strict liability basis.
OFAC’s latest action highlights the continuing evolution of North Korean tactics in using the global IT workforce and digital assets to evade sanctions, emphasizing the need for heightened due diligence in personnel hiring and third-party contracting, particularly in the technology and virtual currency sectors.
The Treasury underlined that the ultimate goal of these sanctions is not punitive, but to incentivize positive behavioral change by restricting North Korea’s access to the international financial system and impeding its malign cyber operations.
For those listed, OFAC provides avenues for seeking removal from the Specially Designated Nationals (SDN) List under the established petition process, reinforcing the dynamic and responsive nature of U.S. sanctions enforcement.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant updates
