The US government has announced new sanctions against North Korea over its army of illegal IT workers who have fraudulently obtained employment to fund the regime’s weapons of mass destruction programs.
North Korea has thousands of “highly skilled” IT workers around the world, mainly in China and Russia, who “generate revenue that contributes to its illegal weapons of mass destruction and ballistic missile programs”, This is according to a statement from the US Treasury Department on Tuesday.
Earning more than $300,000 a year in some cases, these individuals deliberately disguise their identities, locations and nationalities by using stolen identities and forged documents to apply for jobs with employers in “richer countries.” They have secretly worked in a variety of roles and industries, including in “business, health and fitness, social networking, sports, entertainment and lifestyle,” the announcement said.
While these individuals tend to perform legitimate IT work unrelated to malicious cyber activities, mainly on cryptocurrency projects, they use virtual currency exchanges and trading platforms to launder illegally obtained funds back to the DPRK, according to the announcement.
The Treasury Department on Tuesday announced sanctions against four entities that employ “thousands” of North Korean IT workers. One of these is Pyongyang’s Automation University, which the Ministry of Finance describes as one of North Korea’s “first cyber education institutions.” The institution is said to have trained cybercriminals who then go on to work in cyber units associated with the Reconnaissance General Bureau. (RGB) — the country’s main intelligence agency.
The Treasury also approved the Technical Reconnaissance Bureau and its 110th Research Center, which lead North Korean development of offensive cyber tactics and tools. The center is also said to have trained agents from the infamous Lazarus Group, which has been linked to the theft of $625 million in cryptocurrency from Ronin, an Ethereum-based sidechain created for the popular play-to-earn game Axie Infinity.
Sanctions were also announced against the Chinyong Information Technology Cooperation Company and a person named King San Man in connection with their IT work activities.
“Today’s action continues to draw attention to the DPRK’s massive illegal cyber and IT worker operations that fund the regime’s illegitimate weapons of mass destruction and ballistic missile programs,” said Brian E. Nelson, Secretary of the Treasury for Terrorism. and Financial Intelligence. “The United States and our partners remain committed to combating the DPRK’s illegal revenue-generating activities and ongoing efforts to steal funds from financial institutions, virtual currency exchanges, businesses and individuals around the world.”
The US government also warned earlier last year that North Korea-backed hackers were targeting employees of cryptocurrency companies by sending highly targeted phishing emails containing a high-paying job offer to try to lure the victim into a trojanized cryptocurrency application to download.
