Article Details
Scrape Timestamp (UTC): 2025-07-09 18:10:26.015
Source: https://www.theregister.com/2025/07/09/us_sanctions_north_korean_it/
Original Article Text
Click to Toggle View
US sanctions alleged North Korean IT sweatshop leader. Turns out outsourcing coders to bankroll Kim’s nukes doesn’t jibe with Uncle Sam. The US Treasury has imposed sanctions on 38-year-old Song Kum Hyok, a North Korean accused of attempting to hack the Treasury Department and posing as an IT worker to collect revenue and secret data for Pyongyang. According to the feds, Song is also a member of Andariel (aka APT45, Onyx Sleet, and Silent Chollima), which the US sanctioned in 2019 along with fellow DPRK-sponsored cyber crews Lazarus Group and Bluenoroff — not that the sanctions have stopped the criminals from pilfering virtual wallets to pad Kim Jong Un's coffers. The US says Andariel, the cyber-arm of North Korea's military intelligence agency, and its members infected US hospitals with ransomware, laundered the proceeds, and then used them to fund digital intrusions into defense, technology, and government entities worldwide. Plus, according to Uncle Sam, Song played a key role in the fake IT worker scheme, hiring foreign techies to seek remote employment with US-based companies and then splitting the income with them while sending a portion back to North Korea to fund its weapons program and other illicit activities. Between 2022 and 2023, Song allegedly used stolen identities belonging to US residents to create aliases for the foreign workers, who then used these names, Social Security numbers, and addresses to apply for jobs with American companies. "Treasury remains committed to using all available tools to disrupt the Kim regime's efforts to circumvent sanctions through its digital asset theft, attempted impersonation of Americans, and malicious cyber-attacks," Deputy Secretary of the Treasury Michael Faulkender said in a canned statement. In addition to Song, the Treasury Department on Tuesday also sanctioned a Russian national, Gayk Asatryan, who is accused of using his Russia-based companies to employ North Korean IT workers. Asatryan, in mid-2024, allegedly inked two deals with North Korean companies, Korea Songkwang Trading General Corporation and Korea Saenal Trading Corporation, to send up to 80 IT workers to Russia to work for his companies, Asatryan and Fortuna. These four Russian and North Korean firms have also been added to the Specially Designated Nationals list. The sanctions are part of the US government's ongoing efforts to quash North Korean IT worker scams, which have become a major hiring and security issue at almost every Fortune 500 company. Last week, the US Department of Justice said it disrupted multiple North Korean fake IT worker scams at more than 100 US companies. These staffers were using fake or stolen identities while earning salaries and stealing sensitive IP for Pyongyang. In one worker's case, this totaled about $740,000 in ill-gotten gains.
Daily Brief Summary
The U.S. Treasury Department has imposed sanctions on Song Kum Hyok, a North Korean, for cybercrimes including attempts to hack the U.S. Treasury.
Song Kum Hyok is linked to Andariel, a group engaged in ransomware attacks on U.S. hospitals, money laundering, and funding cyber intrusions globally.
Andariel, identified as part of North Korea's military intelligence cyber arm, has previously been sanctioned but continues illicit activities including digital asset theft and impersonation.
The sanctioned operations involve a scheme where foreign IT workers are hired under stolen U.S. identities to infiltrate American companies, splitting income with the North Korean regime.
These activities fund North Korea's weapons programs and were part of efforts to circumvent sanctions.
A Russian national, Gayk Asatryan, and his companies were also sanctioned for employing North Korean IT workers, further supporting Pyongyang's illicit operations.
The U.S. continues to address security concerns posed by North Korean IT workers who are involved in large-scale scams affecting major companies worldwide, including theft of intellectual property.