ABAB News Logo
Back to Flash News

The U.S. OFAC sanctions entities linked to a North Korean IT worker fraud network

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced on October 28 that it was sanctioning 10 individuals and 1 entity. These entities were involved in a network operated by the North Korean government in which IT workers defrauded U.S. companies, and the proceeds were used for North Korea’s weapons of mass destruction and ballistic missile programs.

The sanctioned Russian national Ilya Aleksandrovich Boykov has, since 2024, exchanged about $3.5 million in cryptocurrency for North Korea’s Alis company and provided transaction monitoring and logistical support. The Russian national Vitold Viktorovich Obertas has, since January 2025, completed nearly $2 million in cryptocurrency exchanges for North Korean officials, as well as at least $1.25 million in other currency transactions. Also sanctioned were the North Korea-controlled, Russia-based entity First Financial and Technical Development Center (FFTDC) and its 6 IT workers, who together have generated more than $750,000 for the entity since 2025.

Original sources:

  1. Title: Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses Publisher: U.S. Department of the Treasury Publication date: 2026-10-28 URL：https://home.treasury.gov/news/press-releases/sb0669 Nature of source: U.S. Department of the Treasury official press release Verification: full text read in this session, accessed on 2026-10-28 Supporting content: sanctions on 10 people and 1 entity; Boykov exchanged about $3.5 million in cryptocurrency since 2024 to support Alis; Obertas completed nearly $2 million in crypto exchanges and $1.25 million in other transactions since January 2025; FFTDC and 6 workers generated more than $750,000 since 2025; proceeds used for WMD and ballistic missile programs

  2. Title: OFAC Designates Facilitators of North Korean IT Worker Schemes Targeting US Businesses Publisher: TRM Labs Publication date: 2026-10-28 URL：https://www.trmlabs.com/resources/blog/ofac-designates-facilitators-of-north-korean-it-worker-schemes-targeting-us-businesses Nature of source: blockchain analytics company analysis Verification: read in this session, accessed on 2026-10-28 Supporting content: confirms amounts, entity identities, Russia-based operations, and links to the previously designated Alis/Amnokgang

  3. Title: US sanctions North Korean network accused of defrauding businesses Publisher: Reuters Publication date: 2026-10-28 URL：https://www.reuters.com/world/asia-pacific/us-issues-new-north-korea-related-sanctions-2026-10-28/ Nature of source: media report Verification: read in this session, accessed on 2026-10-28 Supporting content: confirms number of sanctioned parties, FFTDC, and that the proceeds were used for weapons programs

ABAB AI Insight

This sanctions action targets a network in which North Korean IT workers used false identities to obtain remote work at U.S. and other companies and then sent most of their wages back to North Korea. The cryptocurrency exchanges carried out by Russian intermediaries were a key step in moving funds from corporate payroll payments to North Korea-controlled entities.

Alis and FFTDC are both North Korea-linked entities that were previously or were newly designated and that operate IT worker teams in Russia. Boykov’s and Obertas’s roles were to exchange and transfer the workers’ cryptocurrency earnings, rather than to perform IT work directly. OFAC said the network also used artificial intelligence tools to help with identity forgery and fund movement.

This is a follow-up action after a related designation in March 2026. Australia and the European Union also took similar sanctions measures this month against the same type of North Korean IT worker funding network.

ABAB News · Cognitive Law

  1. The income of North Korean IT workers was transferred through cryptocurrency exchanges by Russian intermediaries.

  2. The sanctioned entities operate in Russia, and the workers’ revenue is counted separately by entity.

  3. The sanctions target financial intermediaries and operating entities, not only the end workers.