US sanctions network aiding North Korean IT workers in targeting crypto companies

Key Points

1. The Treasury's Office of Foreign Assets Control sanctioned Song Kum Hyok (linked to North Korea's RGB and Andariel hacking unit) and Gayk Asatryan (a Russian national) for facilitating North Korean IT workers in securing remote crypto jobs.

2. These IT workers, often based in China and Russia, use falsified documents to earn and launder funds, which are then funneled back to North Korea's sanctioned weapons programs.

3. North Korea's cyber infiltration strategy has shifted from high-profile hacks to deception-based methods, embedding operatives in legitimate firms.

4. Crypto investigator ZachXBT estimates that around 920 North Korean IT workers hold crypto jobs, generating over $16 million for the regime.

5. The Department of Justice has brought criminal charges against DPRK-linked operatives as part of efforts to counter these infiltration schemes.