MediumII Cyber Warfare & Critical Infrastructure28 October 2026, Wednesday
US sanctions North Korean IT worker network and its Russian hub
On 28 October OFAC, part of the US Treasury, sanctioned 10 people and 1 Russia-based entity linked to North Korea's network of IT workers placed in US companies under false identities. The network was said to rely on cryptocurrency and AI tools.
OFAC, the Treasury's Office of Foreign Assets Control, designated 10 individuals and 1 entity on 28 October. According to Chainalysis, the entity is the First Financial and Technical Development Center (FFTDC), a North Korean-controlled company operating in Russia. The list includes 2 Russian nationals, 2 North Korean facilitators and 6 North Korean IT workers based in Russia. Since 2025 those 6 workers have generated more than 750,000 dollars for FFTDC. Russian national Vitold Obertas has converted roughly 2 million dollars in cryptocurrency for North Korean officials since January 2025 and carried out at least 1.25 million dollars in other currency transactions.
The method shows the new face of cyber risk. Chainalysis says the workers use generative AI tools that tailor CVs to job adverts, draft cover letters and coach them for technical interviews. In some cases AI-generated profile photos and deepfake video were used. The UN Panel of Experts estimates that these operations earn 250–600 million dollars a year. Yahoo News reported that Russian national Ilya Boykov has converted about 3.5 million dollars in crypto for the North Korean company Alis since 2024. Chainalysis does not give that amount, and the figure could not be verified. Treasury Secretary Scott Bessent said the regime continues to target US companies.
Talay assessment
Bottom line
The weight of the decision lies in geography, not in the sums. North Korea's IT worker revenue line now runs through a hub based in Russia and through Russian intermediaries. The sanctions turn remote hiring at US companies into an identity security problem. As AI-generated CVs and deepfake interviews spread, sanctions alone will not shut the network; the real burden will fall on hiring checks.
Likely effects
- Corporate hiring riskNegative1–6 months
US companies employing remote IT staff will have to tighten identity verification and sanctions screening against the risk of deepfake interviews.
- Crypto intermediariesUncertainWeeks
The 2 million dollars in conversions routed through Russian intermediaries will increase compliance scrutiny of Russia-linked accounts at crypto exchanges.
- US–Russia relationsNegative1–6 months
Documenting that a Russian hub channels North Korean revenue keeps Moscow–Pyongyang cooperation on the sanctions agenda.
Possibilities, ranked
- 1Network adapts with new identities60%
The workers carry on through new front companies and identities, and sanctions widen piecemeal.
Watch: OFAC's next North Korean IT worker designations and Justice Department indictments
- 2Crypto channel narrows25%
Exchanges freeze flagged addresses and the network's cost of converting funds rises.
Watch: Blockchain analytics firms reporting freezes on flagged addresses
- 3Russian retaliation15%
Moscow calls the sanctions political and responds diplomatically to the listing of Russian nationals.
Watch: The Russian Foreign Ministry's official response to the decision
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Sanctions scope▲ 10 people + 1 entity
- UN estimate of annual revenue▼ $250–600m