{"investigation":{"slug":"dprk-it-worker-network-ofac-march-2026-designations","entity_name":"DPRK IT Worker Network — OFAC March 2026 Designations","trust_score":2,"severity_base":null,"score_modifier":0,"confidence":0.85,"status":"draft","content_type":"investigation","summary":"On March 12, 2026, the U.S. Treasury's Office of Foreign Assets Control (OFAC) sanctioned two entities and six individuals — spanning the DPRK, Vietnam, Laos, China, and Spain — for facilitating North Korean information-technology (IT) worker fraud schemes that Treasury says generated nearly $800 million in 2024 to fund the DPRK's weapons of mass destruction and ballistic missile programs. The designated network used stolen identities, fabricated personas, and cryptocurrency conversion and laundering to place North Korean operatives in remote jobs at U.S. and international companies, in some cases followed by data theft and extortion. The action expands a long-running, multi-year OFAC/DOJ/FBI enforcement campaign against DPRK IT worker schemes and is corroborated by primary Treasury and State Department releases as well as blockchain-analytics reporting.","sections":[{"content":"The U.S. Department of the Treasury's Office of Foreign Assets Control announced sanctions on six individuals and two entities for roles in DPRK government-orchestrated IT worker schemes. Treasury said the schemes systematically defrauded U.S. and international businesses and generated nearly $800 million in 2024 for the DPRK's weapons of mass destruction programs. The designated entities were Amnokgang Technology Development Company (a DPRK IT firm that manages delegations of overseas IT workers and conducts illicit procurement of military and commercial technology) and Quangvietdnbg International Services Company Limited, a Vietnam-based currency-conversion firm owned or controlled by designated individual Nguyen Quang Viet. Designations were issued under Executive Order 13810 (North Korea sanctions) and Executive Order 13382 (weapons of mass destruction proliferators). Treasury Secretary Scott Bessent was quoted stating that the North Korean regime 'targets American companies through deceptive schemes carried out by its overseas IT operatives, who weaponize sensitive data and extort businesses for substantial payments.'","heading":"OFAC Designation — March 12, 2026","sources":[{"url":"https://home.treasury.gov/news/press-releases/sb0416","name":"Treasury Sanctions DPRK IT Worker Fraud Facilitators — U.S. Department of the Treasury press release sb0416","type":"regulatory","credibility":1},{"url":"https://www.nknews.org/2026/03/us-blacklists-2-companies-6-individuals-over-north-korean-it-worker-schemes/","name":"US blacklists 2 companies, 6 individuals over North Korean IT worker schemes — NK News","type":"news_article","credibility":2},{"url":"https://www.state.gov/releases/office-of-the-spokesperson/2026/03/sanctions-to-disrupt-dprk-it-worker-schemes-defrauding-u-s-businesses/","name":"Sanctions to Disrupt DPRK IT Worker Schemes Defrauding U.S. Businesses — U.S. Department of State","type":"official","credibility":1}],"severity":"critical"},{"content":"The designated parties named in the OFAC action include: Amnokgang Technology Development Company (DPRK IT firm managing overseas worker delegations, designated under E.O. 13810); Nguyen Quang Viet, CEO of Quangvietdnbg International Services Company Limited (Vietnam), alleged to have converted approximately $2.5 million into cryptocurrency for North Koreans between mid-2023 and mid-2025, including illicit IT worker earnings; Quangvietdnbg International Services Company Limited itself, alleged to be owned or controlled by Nguyen; Do Phi Khanh, described as an associate and proxy of previously sanctioned DPRK procurement facilitator Kim Se Un, alleged to have allowed his identity to be used to open bank accounts and launder IT-worker proceeds (designated under E.O. 13382); Hoang Van Nguyen (Vietnam), alleged to have assisted Kim Se Un in opening bank accounts and enabling cryptocurrency transactions, and to have facilitated a counterfeit-cigarette transaction exceeding $200,000 in 2022; Yun Song Guk, a North Korean national alleged to have led a group of DPRK IT workers conducting freelance IT work from Boten, Laos since at least 2023, and alleged to have coordinated financial transactions exceeding $70,000; Hoang Minh Quang (Vietnam), alleged to have received more than $70,000 in payments from Yun Song Guk tied to IT services; and York Louis Celestino Herrera (Spain), alleged to have worked with Yun since 2024 to develop freelance IT service contracts. All allegations originate from the OFAC designation and have not been independently adjudicated in a court of law; they should be treated as allegations pending any related criminal proceedings.","heading":"Named Individuals and Entities","sources":[{"url":"https://home.treasury.gov/news/press-releases/sb0416","name":"Treasury Sanctions DPRK IT Worker Fraud Facilitators — U.S. Department of the Treasury press release sb0416","type":"regulatory","credibility":1},{"url":"https://thehackernews.com/2026/03/ofac-sanctions-dprk-it-worker-network.html","name":"OFAC Sanctions DPRK IT Worker Network Funding WMD Programs Through Fake Remote Jobs — The Hacker News","type":"news_article","credibility":2}],"severity":"critical"},{"content":"OFAC's designation included 21 cryptocurrency addresses across multiple blockchain networks, including Bitcoin, Ethereum, and Tron, tied to the sanctioned parties. According to blockchain-analytics firm TRM Labs, seven addresses tied to Amnokgang Technology Development Company alone had processed over $12 million in transactions, with funds allegedly routed through intermediary addresses to the OFAC-sanctioned Cheil Credit Bank, high-risk exchanges, and darknet markets. Treasury stated that facilitators in the network converted digital assets into cash or used crypto transactions to obscure the origin of funds before transferring them to accounts linked to the regime. Separately, OFAC amended an existing designation for Sim Hyon-Sop — a previously sanctioned (April 2023) representative of Korea Kwangson Banking Corporation, a bank tied to DPRK weapons-of-mass-destruction financing — adding roughly 11 additional cryptocurrency addresses tied to his continued activity in China, reported to be ongoing despite an existing indictment against him. Chainalysis identified the broader network as spanning Vietnam, Laos, and Spain, using exchanges, hosted wallets, and decentralized finance platforms to obscure fund transfers.","heading":"Cryptocurrency Addresses and Laundering Methods","sources":[{"url":"https://regtechtimes.com/ofac-lists-crypto-wallets-linked-to-north-korea/","name":"OFAC lists 21 crypto wallets linked to North Korea IT worker network generating $800 million — Regtechtimes","type":"news_article","credibility":2},{"url":"https://www.trmlabs.com/resources/blog/beyond-it-worker-fraud-ofacs-latest-dprk-designations-show-broader-sanctions-and-national-security-risk","name":"Beyond IT Worker Fraud: OFAC's Latest DPRK Designations Show Broader Sanctions and National Security Risk — TRM Labs","type":"research","credibility":2},{"url":"https://www.chainalysis.com/blog/ofac-targets-north-korean-it-workers-crypto-march-2026/","name":"OFAC Targets DPRK IT Workers Using Crypto — Chainalysis","type":"research","credibility":2}],"severity":"high"},{"content":"Across multiple accounts of the scheme, North Korean IT operatives allegedly secured remote employment at legitimate global companies — including in the United States — using stolen identities, forged documents, and fabricated personas, in some cases employing AI-based tools such as face-swap technology to generate fake credentials and headshots. Beyond wage theft (with the DPRK government reportedly appropriating the large majority of workers' earnings), the operatives allegedly in some instances embedded malware into corporate systems to exfiltrate sensitive data, which was then used to extort victim companies for payment, often demanded in cryptocurrency. Some workers were reported to be operating from China using VPN services such as Astrill to mask their location and evade the Great Firewall while posing as domestic remote employees. These operational details are drawn from secondary reporting synthesizing the Treasury designation and should be treated with a level of caution appropriate to unverified, allegation-based claims where court records are not yet public.","heading":"Method of Operation: Identity Fraud, Malware, and Extortion","sources":[{"url":"https://thehackernews.com/2026/03/ofac-sanctions-dprk-it-worker-network.html","name":"OFAC Sanctions DPRK IT Worker Network Funding WMD Programs Through Fake Remote Jobs — The Hacker News","type":"news_article","credibility":2},{"url":"https://www.crowdfundinsider.com/2026/03/266528-chainalysis-shares-insights-after-ofac-sanctions-north-korean-it-networks-over-crypto-enabled-sanctions-evasion/","name":"Chainalysis Shares Insights After OFAC Sanctions North Korean IT Networks Over Crypto-Enabled Sanctions Evasion — Crowdfund Insider","type":"news_article","credibility":2}],"severity":"high"},{"content":"The March 2026 action is part of a recurring, multi-year OFAC enforcement pattern against DPRK IT worker networks rather than an isolated event. In an earlier related action dated August 27, 2025, OFAC designated Russian national Vitaliy Sergeyevich Andreyev, DPRK trade official Kim Ung Sun, Chinese front company Shenyang Geumpungri Network Technology Co., Ltd, and Korea Sinjin Trading Corporation under Executive Order 13687, alleging that Andreyev facilitated approximately $600,000 in cryptocurrency-to-cash conversions since December 2024, and that Shenyang Geumpungri's IT worker delegation had earned over $1 million in profits for related DPRK entities since 2021. Some entities named in that August 2025 action (Shenyang Geumpungri, Korea Sinjin Trading Corporation) recur in reporting tied to the broader IT-worker network discussed in the March 2026 designations, indicating overlapping infrastructure across multiple rounds of sanctions.","heading":"Pattern of Prior Enforcement","sources":[{"url":"https://home.treasury.gov/news/press-releases/sb0230","name":"Treasury Sanctions DPRK Fraud Network — U.S. Department of the Treasury press release sb0230","type":"regulatory","credibility":1}],"severity":"medium"},{"content":"Sim Hyon-Sop, whose existing OFAC designation (originally issued in April 2023) was amended in the March 2026 action with additional cryptocurrency addresses, is separately reported to be the subject of a U.S. indictment and a related civil forfeiture action; a U.S. court reportedly ordered the seizure of approximately $212,000 in cryptocurrency tied to North Korean IT worker proceeds in a case connected to Sim. Sim is alleged to have acted as an agent for Korea Kwangson Banking Corporation, an entity previously sanctioned for its role in financing DPRK weapons of mass destruction programs, and reporting indicates a monetary reward (reported at approximately $7 million) has been offered for information leading to his arrest. These details derive from secondary crypto-industry press coverage rather than a primary DOJ filing directly reviewed in this investigation, and should be treated as moderate-confidence pending direct review of court records.","heading":"Related Criminal Case — Sim Hyon-Sop","sources":[{"url":"https://crypto.news/u-s-court-orders-seizure-of-212k-crypto-tied-to-north-korean-it-workers/","name":"U.S. court orders seizure of $212K crypto tied to North Korean IT workers — crypto.news","type":"news_article","credibility":2},{"url":"https://news.sbs.co.kr/english/article.do?news_id=N1008743488","name":"US Court Orders Forfeiture of North Korean Crypto Tied to Money Laundering; Who Is Sim Hyon-sop with a $7 Million Bounty? — SBS News (English)","type":"news_article","credibility":2}],"severity":"high"}],"timeline":[{"date":"2021","event":"Shenyang Geumpungri Network Technology Co., Ltd's delegation of DPRK IT workers reportedly began generating profits (later alleged to exceed $1 million) for Chinyong and Korea Sinjin Trading Corporation, according to a subsequent OFAC designation.","source":"U.S. Department of the Treasury press release sb0230","source_url":"https://home.treasury.gov/news/press-releases/sb0230"},{"date":"2023","event":"Yun Song Guk allegedly began leading a group of North Korean IT workers conducting freelance IT work from Boten, Laos.","source":"U.S. Department of the Treasury press release sb0416","source_url":"https://home.treasury.gov/news/press-releases/sb0416"},{"date":"2024","event":"DPRK IT worker schemes are alleged by Treasury to have generated nearly $800 million for the regime's weapons of mass destruction programs during this year.","source":"U.S. Department of the Treasury press release sb0416","source_url":"https://home.treasury.gov/news/press-releases/sb0416"},{"date":"2025-08-27","event":"OFAC sanctioned Vitaliy Sergeyevich Andreyev, Kim Ung Sun, Shenyang Geumpungri Network Technology Co., Ltd, and Korea Sinjin Trading Corporation under Executive Order 13687 for roles in a related DPRK IT worker fraud network.","source":"U.S. Department of the Treasury press release sb0230","source_url":"https://home.treasury.gov/news/press-releases/sb0230","date_evidence":"Date of Designation: August 27, 2025"},{"date":"2026-03-12","event":"OFAC designated Amnokgang Technology Development Company, Quangvietdnbg International Services Company Limited, and six individuals (Nguyen Quang Viet, Do Phi Khanh, Hoang Van Nguyen, Yun Song Guk, Hoang Minh Quang, York Louis Celestino Herrera) for facilitating DPRK IT worker fraud schemes; OFAC also amended the existing designation of Sim Hyon-Sop with additional cryptocurrency addresses.","source":"U.S. Department of the Treasury press release sb0416 / NK News","source_url":"https://home.treasury.gov/news/press-releases/sb0416","date_evidence":"On March 12, 2026, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) sanctioned six individuals and two entities for their roles in Democratic People's Republic of Korea (DPRK) government-orchestrated information technology (IT) worker schemes"}],"sources_used":[{"url":"https://home.treasury.gov/news/press-releases/sb0416","name":"Treasury Sanctions DPRK IT Worker Fraud Facilitators — U.S. Department of the Treasury press release sb0416","type":"regulatory","archive_url":"http://web.archive.org/web/20260826185518/https://home.treasury.gov/news/press-releases/sb0416","credibility":1,"archive_timestamp":"2026-08-26T18:55:18+00:00"},{"url":"https://home.treasury.gov/news/press-releases/sb0230","name":"Treasury Sanctions DPRK Fraud Network — U.S. Department of the Treasury press release sb0230","type":"regulatory","archive_url":"http://web.archive.org/web/20260904093515/https://home.treasury.gov/news/press-releases/sb0230","credibility":1,"archive_timestamp":"2026-09-04T09:35:15+00:00"},{"url":"https://www.state.gov/releases/office-of-the-spokesperson/2026/03/sanctions-to-disrupt-dprk-it-worker-schemes-defrauding-u-s-businesses/","name":"Sanctions to Disrupt DPRK IT Worker Schemes Defrauding U.S. Businesses — U.S. Department of State","type":"official","archive_url":"http://web.archive.org/web/20260428070839/https://www.state.gov/releases/office-of-the-spokesperson/2026/03/sanctions-to-disrupt-dprk-it-worker-schemes-defrauding-u-s-businesses/","credibility":1,"archive_timestamp":"2026-04-28T07:08:39+00:00"},{"url":"https://www.nknews.org/2026/03/us-blacklists-2-companies-6-individuals-over-north-korean-it-worker-schemes/","name":"US blacklists 2 companies, 6 individuals over North Korean IT worker schemes — NK News","type":"news_article","archive_url":"http://web.archive.org/web/20260314093005/https://www.nknews.org/2026/03/us-blacklists-2-companies-6-individuals-over-north-korean-it-worker-schemes/","credibility":2,"archive_timestamp":"2026-03-14T09:30:05+00:00"},{"url":"https://thehackernews.com/2026/03/ofac-sanctions-dprk-it-worker-network.html","name":"OFAC Sanctions DPRK IT Worker Network Funding WMD Programs Through Fake Remote Jobs — The Hacker News","type":"news_article","archive_url":"http://web.archive.org/web/20260901035414/https://thehackernews.com/2026/03/ofac-sanctions-dprk-it-worker-network.html","credibility":2,"archive_timestamp":"2026-09-01T03:54:14+00:00"},{"url":"https://www.chainalysis.com/blog/ofac-targets-north-korean-it-workers-crypto-march-2026/","name":"OFAC Targets DPRK IT Workers Using Crypto — Chainalysis","type":"research","archive_url":"http://web.archive.org/web/20260420025036/https://www.chainalysis.com/blog/ofac-targets-north-korean-it-workers-crypto-march-2026/","credibility":2,"archive_timestamp":"2026-04-20T02:50:36+00:00"},{"url":"https://www.crowdfundinsider.com/2026/03/266528-chainalysis-shares-insights-after-ofac-sanctions-north-korean-it-networks-over-crypto-enabled-sanctions-evasion/","name":"Chainalysis Shares Insights After OFAC Sanctions North Korean IT Networks Over Crypto-Enabled Sanctions Evasion — Crowdfund Insider","type":"news_article","archive_url":"http://web.archive.org/web/20260314152317/https://www.crowdfundinsider.com/2026/03/266528-chainalysis-shares-insights-after-ofac-sanctions-north-korean-it-networks-over-crypto-enabled-sanctions-evasion/","credibility":2,"archive_timestamp":"2026-03-14T15:23:17+00:00"},{"url":"https://crypto.news/us-sanctions-network-tied-to-dprk-crypto-laundering/","name":"US sanctions network tied to DPRK IT jobs and crypto laundering operation — crypto.news","type":"news_article","archive_url":"http://web.archive.org/web/20260418094703/https://crypto.news/us-sanctions-network-tied-to-dprk-crypto-laundering/","credibility":2,"archive_timestamp":"2026-04-18T09:47:03+00:00"},{"url":"https://regtechtimes.com/ofac-lists-crypto-wallets-linked-to-north-korea/","name":"OFAC lists 21 crypto wallets linked to North Korea IT worker network generating $800 million — Regtechtimes","type":"news_article","archive_url":"http://web.archive.org/web/20260413145413/https://regtechtimes.com/ofac-lists-crypto-wallets-linked-to-north-korea/","credibility":2,"archive_timestamp":"2026-04-13T14:54:13+00:00"},{"url":"https://www.trmlabs.com/resources/blog/beyond-it-worker-fraud-ofacs-latest-dprk-designations-show-broader-sanctions-and-national-security-risk","name":"Beyond IT Worker Fraud: OFAC's Latest DPRK Designations Show Broader Sanctions and National Security Risk — TRM Labs","type":"research","archive_url":"http://web.archive.org/web/20260725171155/https://www.trmlabs.com/resources/blog/beyond-it-worker-fraud-ofacs-latest-dprk-designations-show-broader-sanctions-and-national-security-risk","credibility":2,"archive_timestamp":"2026-07-25T17:11:55+00:00"},{"url":"https://crypto.news/u-s-court-orders-seizure-of-212k-crypto-tied-to-north-korean-it-workers/","name":"U.S. court orders seizure of $212K crypto tied to North Korean IT workers — crypto.news","type":"news_article","archive_url":"https://web.archive.org/web/20260924005103/https://crypto.news/u-s-court-orders-seizure-of-212k-crypto-tied-to-north-korean-it-workers/","credibility":2,"archive_timestamp":"2026-09-24T00:51:03+00:00"},{"url":"https://news.sbs.co.kr/english/article.do?news_id=N1008743488","name":"US Court Orders Forfeiture of North Korean Crypto Tied to Money Laundering; Who Is Sim Hyon-sop with a $7 Million Bounty? — SBS News (English)","type":"news_article","archive_url":"https://web.archive.org/web/20260924005337/https://news.sbs.co.kr/english/article.do?news_id=N1008743488","credibility":2,"archive_timestamp":"2026-09-24T00:53:37+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-23T23:13:55.104174+00:00","updated_at":"2026-09-24T03:21:29.788151+00:00"}}