OFAC sanctions DPRK IT worker scheme network
Regulatory/Legal Action
Summary
Hide ▲
Show ▼
OFAC sanctioned Ryujong Credit Bank, KMCTC, and eight individuals tied to North Korean cryptocurrency laundering and fraudulent IT worker schemes. The U.S. Treasury Department said the network used sanctions-evasion and money laundering channels between North Korea and China, while also supporting IT worker operations in China and fund movements linked to ransomware attacks targeting U.S. victims. Officials said North Korea-affiliated cybercriminals have stolen over $3 billion over the past three years, and the sanctions block property under U.S. jurisdiction while raising secondary sanctions risk for counterparties.
Related Happenings
U.S. Department of State offers RFJ reward for BPH-linked cyber actors
Public Sector Action
H score32
First: 15.07.2026 10:45
Last: 15.07.2026 10:45
Sources 1
About this happening:
The U.S. Department of State is now offering up to $10 million through Rewards for Justice (RFJ) for information tied to the alleged bulletproof hosting operators...
U.S. Department of State offers RFJ reward for BPH-linked cyber actors
Public Sector ActionAbout this happening: The U.S. Department of State is now offering up to $10 million through Rewards for Justice (RFJ) for information tied to the alleged bulletproof hosting operators...
OFAC sanctions First VPN Service and two individuals
Regulatory/Legal Action
H score27
First: 14.07.2026 11:02
Last: 14.07.2026 11:02
Sources 1
About this happening:
OFAC sanctioned First VPN Service (1VPNS), Dmytro Rashevskyi, and Yegeniy Vladimirovich Silayev for enabling ransomware attacks and helping malicious software...
OFAC sanctions First VPN Service and two individuals
Regulatory/Legal ActionAbout this happening: OFAC sanctioned First VPN Service (1VPNS), Dmytro Rashevskyi, and Yegeniy Vladimirovich Silayev for enabling ransomware attacks and helping malicious software...
Treasury sanctions Prince Group-linked entities and FinCEN designates H-Pay Service
Regulatory/Legal Action
H score17
First: 24.06.2026 11:55
Last: 24.06.2026 11:55
Sources 1
About this happening:
The U.S. Treasury imposed fresh sanctions on nine individuals and 26 entities linked to Prince Group, while FinCEN designated H-Pay Service PLC as a prim...
Treasury sanctions Prince Group-linked entities and FinCEN designates H-Pay Service
Regulatory/Legal ActionAbout this happening: The U.S. Treasury imposed fresh sanctions on nine individuals and 26 entities linked to Prince Group, while FinCEN designated H-Pay Service PLC as a prim...
North Korea-aligned developer-targeting operations shift from fake interviews to recruitment phishing at scale
Threat Actor Meta
H score31
First: 15.06.2026 22:32
Last: 15.06.2026 22:32
Sources 1
About this happening:
North Korea-aligned developer-targeting operations are shifting from fake interviews to recruitment-themed phishing at scale, increasing the risk of industrialized crede...
North Korea-aligned developer-targeting operations shift from fake interviews to recruitment phishing at scale
Threat Actor MetaAbout this happening: North Korea-aligned developer-targeting operations are shifting from fake interviews to recruitment-themed phishing at scale, increasing the risk of industrialized crede...
OFAC sanctions Nobitex and designates executives
Regulatory/Legal Action
H score21
First: 03.06.2026 23:31
Last: 03.06.2026 23:31
Sources 1
About this happening:
OFAC sanctioned Nobitex and designated its executives and founders, freezing covered U.S.-jurisdiction assets and blocking U.S. business with the exchange and its leaders....
OFAC sanctions Nobitex and designates executives
Regulatory/Legal ActionAbout this happening: OFAC sanctioned Nobitex and designated its executives and founders, freezing covered U.S.-jurisdiction assets and blocking U.S. business with the exchange and its leaders....
Timeline
-
18.03.2026 19:26 1 articles · 3mo ago
Remote worker hired for Salesforce data role in DPRK IT worker scheme
Exploitation ObservedAn IT worker was hired on August 15, 2025 as a remote employee to work on Salesforce data for an affected organization after replying to a help wanted ad, establishing access for a fraudulent employment effort tied to the DPRK IT worker scheme.
Show sources
- OFAC Sanctions DPRK IT Worker Network Funding WMD Programs Through Fake Remote Jobs — thehackernews.com — 18.03.2026 19:26
-
18.03.2026 19:26 1 articles · 3mo ago
Remote worker terminated after consistent logins from China
Detection Ioc UpdateThe same remote employee was terminated on August 25, 2025 after indicators showed consistent logins from China, exposing suspicious access activity at the affected organization.
Show sources
- OFAC Sanctions DPRK IT Worker Network Funding WMD Programs Through Fake Remote Jobs — thehackernews.com — 18.03.2026 19:26
-
18.03.2026 19:26 4 articles · 3mo ago
OFAC sanctions DPRK IT worker network
Legal Policy Action UpdateOn March 18, 2026, OFAC sanctioned six individuals and two entities tied to the DPRK IT worker scheme, which used bogus documentation, stolen identities, fabricated personas, malware, and extortion to defraud U.S. businesses and generate illicit revenue for North Korea's WMD programs.
Show sources
- OFAC Sanctions DPRK IT Worker Network Funding WMD Programs Through Fake Remote Jobs — thehackernews.com — 18.03.2026 19:26
- OFAC Sanctions DPRK IT Worker Network Funding WMD Programs Through Fake Remote Jobs — thehackernews.com — 18.03.2026 19:26
- U.S. Treasury Sanctions DPRK IT-Worker Scheme, Exposing $600K Crypto Transfers and $1M+ Profits — thehackernews.com — 28.08.2025 11:53
- US sanctions North Korean bankers linked to cybercrime, IT worker fraud — www.bleepingcomputer.com — 05.11.2025 12:34