{"id":25636,"date":"2025-07-10T22:49:56","date_gmt":"2025-07-10T19:49:56","guid":{"rendered":"https:\/\/digitrendz.blog\/?p=25636"},"modified":"2025-07-10T22:49:59","modified_gmt":"2025-07-10T19:49:59","slug":"us-treasury-sanctions-north-korea-for-it-worker-malware-plot","status":"publish","type":"post","link":"https:\/\/digitrendz.blog\/z\/newswire\/25636\/us-treasury-sanctions-north-korea-for-it-worker-malware-plot\/","title":{"rendered":"US Treasury Sanctions North Korea for IT Worker Malware Plot"},"content":{"rendered":"
\u25bc Summary<\/summary>\n

– The U.S. Treasury sanctioned North Korean cyber operative Song Kum Hyok for using fake identities to infiltrate U.S. companies and fund Pyongyang\u2019s weapons programs.
– Song facilitated overseas IT workers with falsified documents to secure remote jobs, funneling earnings back to North Korea for military development.
– Stolen personal data, including Social Security numbers, was used to create fake aliases for operatives between 2022 and 2023.
– Five additional entities tied to the operation were blacklisted, freezing U.S. assets and banning American businesses from engaging with them.
– The crackdown aims to disrupt North Korea\u2019s cybercrime revenue streams financing weapons programs, following recent raids on IT worker networks.<\/p>\n<\/details>\n\n

<\/p>\n\n

T<\/mark>he U.S. Treasury<\/a><\/strong> has sanctioned a North Korean<\/a> cyber operative<\/strong> at the center of a covert scheme that used fake identities<\/strong> to sneak operatives into American companies and quietly funnel wages back to Pyongyang<\/a>\u2019s weapons programs<\/strong>. The target, Song Kum Hyok<\/a><\/strong>, is identified as a key figure in Andariel<\/strong>, a hacking group notorious for ransomware attacks<\/a><\/strong> and crypto thefts<\/strong> that help bankroll North Korea\u2019s military ambitions.<\/p>\n\n

According to investigators, Song supplied falsified U.S. documents<\/strong> to overseas IT workers, mainly based in China<\/a> and Russia<\/a><\/strong>, letting them land remote jobs with unsuspecting U.S. employers<\/strong>. A slice of each paycheck reportedly flowed back to fund weapons of mass destruction<\/strong> and ballistic missile development<\/a><\/strong>. Some workers did more than collect salaries, they quietly planted malware<\/strong> on corporate networks, opening doors for future hacks.<\/p>\n\n

Between 2022 and 2023<\/strong>, Song\u2019s network used stolen Social Security numbers and addresses<\/strong> to craft credible aliases. The Treasury\u2019s Office of Foreign Assets Control<\/a> (OFAC)<\/strong> also blacklisted five additional entities<\/strong>, including Gayk Asatryan<\/a><\/strong>, a Russian national<\/strong> who hired North Korean IT staff through his companies.<\/p>\n\n

Under the sanctions, all U.S.-based assets<\/strong> belonging to these parties are frozen, and American businesses<\/strong> are barred from any dealings. Foreign banks<\/strong> that continue to do business with the blacklisted network could face penalties too.<\/p>\n\n

This crackdown ties into a wider Justice Department<\/a> push<\/strong> to dismantle North Korea\u2019s IT worker schemes<\/strong>. Earlier this month, federal agents raided 29 so-called \u201claptop farms<\/a>\u201d<\/strong>, makeshift offices where these operatives worked undercover. Those raids led to arrests<\/strong>, indictments<\/strong>, and the seizure of websites<\/strong> and financial channels<\/strong> used to hide the money trail.<\/p>\n\n

By blocking these cybercrime cash streams<\/strong>, Washington aims to squeeze Pyongyang\u2019s ability to keep building its banned weapons. The sanctions highlight how state-backed hacking groups<\/strong> increasingly exploit global hiring systems<\/strong> to launder money and fuel prohibited military projects<\/p>\n\n

(Source: BLEEPINGCOMPUTER<\/a>)<\/em><\/p>","protected":false},"excerpt":{"rendered":"

Treasury has imposed sanctions on a North Korean cyber operative involved in a sophisticated scheme using fake identities to infiltrate American companies and fund Pyongyang\u2019s weapons programs.** The move targets **Song Kum Hyok**, a key member of the **Andariel hacking group**, known for orchest…<\/p>\n","protected":false},"author":1,"featured_media":25635,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_themeisle_gutenberg_block_has_review":false,"cybocfi_hide_featured_image":"","footnotes":""},"categories":[3327],"tags":[37294,37295,37297,37298,37296],"entities":[37358,1322,37360,6449,32883,33433,37359,2371,37357,37356],"class_list":["post-25636","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-newswire","tag-korea-for","tag-north-korea","tag-sanctions-north","tag-treasury-sanctions","tag-worker-malware","entity-andariel-hacking-group","entity-china","entity-gayk-asatryan","entity-justice-department","entity-north-korean","entity-office-of-foreign-assets-control","entity-pyongyang","entity-russia","entity-song-kum-hyok","entity-u-s-treasury"],"_links":{"self":[{"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/posts\/25636","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/comments?post=25636"}],"version-history":[{"count":0,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/posts\/25636\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/media\/25635"}],"wp:attachment":[{"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/media?parent=25636"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/categories?post=25636"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/tags?post=25636"},{"taxonomy":"entity","embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/entities?post=25636"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}