US: Sanctions on 10 North Korean entities for money laundering

The United States Treasury Department has imposed sanctions on eight individuals and two entities in financial network North Korea's for laundering money from various illegal activities (including cybercrime and IT employee fraud).

“North Korea’s state-sponsored hackers are stealing and laundering money to nuclear weapons program regime’s,” said John K. Hurley, Under Secretary of the Treasury for Terrorism and Financial Intelligence. “By generating revenue for Pyongyang’s weapons development, these actors directly threaten the security of the United States and the world. The Treasury Department will continue to pursue the facilitators and supporters behind these activities to disrupt the DPRK’s illicit revenue streams.”

See also: Silent Lynx targets government employees

Sanctions on North Korean individuals and entities

The individuals and entities targeted by the sanctions are:

• Jang Kuk Chol and Ho Jong Son, who allegedly helped manage funds, including $5.3 million in cryptocurrencies, on behalf of First Credit Bank (also known as Cheil Credit Bank), which was already sanctioned in September 2017 for facilitating missile programs .

• Korea Mangyongdae Computer Technology Company (KMCTC), a North Korean-based IT company, has sent two delegations of IT workers to the Chinese cities of Shenyang and Dandong and has used Chinese nationals as banking proxies to conceal the origin of funds generated under the fraudulent employment scheme.

• U Yong Su, the current president of KMCTC.

• Ryujong Credit Bank, which has provided financial assistance to sanctions evasion activities between China and North Korea.

• Ho Yong Chol, Han Hong Gil, Jong Sung Hyok, Choe Chun Pom, and Ri Jin Hyok, who are representatives of North Korean financial institutions in Russia and China and are alleged to have facilitated transactions worth millions of dollars on behalf of the sanctioned banks.

A portion of the $5.3 million has been linked to a North Korean ransomware perpetrator who has targeted victims in the US and managed proceeds from North Korea's notorious malicious IT worker operations.

See also: Details on Tycoon 2FA Phishing Kit attack techniques

Describing North Korean cybercriminals as orchestrators of espionage, disruptive attacks and financial, the Treasury Department said Pyongyang-linked cybercriminals have stolen more than $3 billion, mostly in digital assets, in the past three years.

The ministry also accused the regime of exploiting IT army , located around the world, to obtain employment in companies (and therefore access to systems) by hiding their nationality and identities. The employees aim to send a significant portion of their income to the Democratic People's Republic of Korea (DPRK), while they can also steal useful corporate information.

“In some cases, DPRK IT workers work with other foreign freelance programmers to create business partnerships,” he added. “They work with these non-North Korean freelancers on projects that were initially assigned to these workers. Then they share the revenue.”

According to TRM Labs, cryptocurrency wallet addresses linked to First Credit Bank show “continuous inflows that resemble salary payments.” These flows likely represent income from IT workers employed overseas under false identities.

See also: New 'SleepyDuck' malware on Open VSX allows remote control of Windows

In total, the wallets, controlled by the bank, reportedly received over $12.7 million between June 2023 and May 2025, indicating continuous activity for two years.

“Together, these individuals and entities constitute a central component of Pyongyang’s sanctions evasion architecture, allowing the regime to move millions of dollars through both traditional and digital channels, including cryptocurrencies, to fund weapons programs and cyber operations,” the blockchain intelligence firm said.