New accomplices of North Korean IT specialists have been revealed. There is a Russian among them

On August 27, 2025, the US Treasury Department’s Office of Foreign Assets Control (OFAC) announced sanctions against a network of individuals and companies that facilitate North Korea's revenue generation through its overseas IT workers. GetBlock AML Research provides a brief review of the new restrictive measures against accomplices of the North Korean authorities.

Russian citizen Vitaliy Sergeyevich Andreyev was included in the sanctions list. He was accused of helping to transfer money to Chinyong Information Technology Cooperation Company. This organization has previously been subject to US sanctions and is linked to the DPRK Ministry of Defense. It hires North Korean programmers and IT specialists in Russia and Laos. According to the Treasury Department, since December 2024, Andreyev and Kim Ung Sun have converted more than $600 000 from cryptocurrency to US dollars.

The sanctions list also includes two companies that helped manage the cash flows of the Chinyong network:

• Shenyang Geumpungri Network Technology Co., Ltd. — a front company in China that supports Chinyong’s operations.
• Korea Sinjin Trading Corporation — a North Korean organization subordinate to the political administration of the DPRK Ministry of People’s Armed Forces General Political Bureau.

How North Korea uses IT specialists abroad

North Korea is increasingly relying on its programmers working in other countries to earn money for military programs that are banned. This is a direct violation of US and UN sanctions. To get a job, North Korean IT specialists often use fake documents, fictitious identities, and even get hired by legitimate companies around the world, including in the United States.

Their salaries, which total hundreds of millions of dollars, are almost entirely taken by the state and directed toward prohibited projects. Sometimes these workers also installed malware to steal important technologies from companies.

Cryptocurrency transfers and surveillance

OFAC identified one crypto wallet linked to Andreyev.

Visualization: TRM Labs

Diagram of cryptocurrency movement through Andreyev’s wallet

These sanctions were a continuation of previous US actions against North Korean intermediaries in Russia, China, and Southeast Asia. For example, on July 8, 2025, OFAC imposed sanctions against another person linked to the North Korean IT scheme. He was accused of laundering millions of stolen cryptocurrency funds through shell companies and unofficial brokers.

Hackers from North Korea find jobs in foreign IT companies. How it happens

North Korea has found another source of funding — using large international technology and crypto companies

Read more

Cryptocurrency remains North Korea’s main tool for circumventing sanctions. It is particularly effective when used in conjunction with front companies and intermediaries in various countries. The new US measures show how this system works and underscore the importance of vetting all counterparties for links to North Korean IT networks.