The U.S. Treasury Department on Tuesday sanctioned four North Korean entities and one person for their role in a fundraising scheme that uses cryptocurrency to funnel stolen money and salaries “fraudulently” earned abroad back to Pyongyang for its weapons program.
The sanctioned entities include the Pyongyang University of Automation, described as one of the North's "premier cyber instruction institutions," and the Technical Reconnaissance Bureau, which the Treasury Department says works closely with Lazarus Group, a team of hackers who last year stole US$620 million in cryptocurrency.
The 110th Research Center, a subsidiary of the Technical Reconnaissance Bureau that has created “outages” at South Korean media outlets and attacked financial and government institutions in Seoul, has also been added to the U.S. sanctions list.
All three entities are accused of “malicious cyber activities” to steal funds for use in Pyongyang’s nuclear weapons program, with South Korea’s government also simultaneously issuing similar sanctions.
"Today's action continues to highlight the DPRK's extensive illicit cyber and IT worker operations, which finance the regime's unlawful weapons of mass destruction and ballistic missile programs," Brian Nelson, under secretary of the treasury, said in a statement.
$300,000 annual salaries
The list of sanctions entities, though, also includes the Chinyong Information Technology Cooperation Company, which is accused of managing computer specialists who “fraudulently” work remotely at companies in developed countries and earn hefty salaries.
“In addition to theft resulting from cyber intrusions, the DPRK generates significant revenue through the deployment of IT workers who fraudulently obtain employment with companies around the world, including in the technology and virtual currency industries,” the Treasury statement said, using an acronym for the North Korean regime.
“The DPRK maintains a workforce of thousands of highly skilled IT workers around the world, primarily located in the People’s Republic of China and Russia, to generate revenue that contributes to its unlawful WMD and ballistic missile programs,” it continued.
“In some cases, DPRK IT workers can each earn more than US$300,000 per year,” it said.
The workers “obfuscate their identities, locations, and nationalities, typically using fake personas, proxy accounts, stolen identities, and falsified or forged documentation” to apply for remote jobs at firms in wealthy countries, the statement said.
They have developed apps across the categories of “business, health and fitness, social networking, sports, entertainment, and lifestyle,” it added.
The Treasury Statement also says one individual – Kim Sang Man – has been sanctioned for managing “the payment of salaries to family members of Chinyong’s overseas DPRK worker delegations.”
‘A sharp break’
Experts told Radio Free Asia that cutting off financing was a critical part of weakening the North’s nuclear weapons program.
The sanctions represent an “important step in degrading North Korea’s ability to engage in illicit cyber-attacks to generate revenue” and raise awareness of how crypto is being misused, said Troy Stangarone, a senior director at the Washington-based Korea Economic Institute.
“In addition to making it more difficult for North Korea to act, the new designation is a reminder to crypto businesses and tech companies that North Korea is working to exploit their systems for its own gains and the need to take additional precautions,” Stangarone said.
Bruce Klinger, a senior fellow at the Heritage Foundation, meanwhile, said the simultaneous sanctions issued by South Korean President Yoon Suk Yeol’s government showed the year-old administration in Seoul was taking a less diplomatic route than its predecessor.
The cooperation marks “a sharp break from the Moon Jae-in administration which sought to reduce international sanctions and law enforcement measures against North Korea as well as downplaying Pyongyang's human rights violations,” Klinger said.
Edited by Malcolm Foster.