OFAC sanctioned Song Kum Hyok, a DPRK cyber actor associated with the Reconnaissance General Bureau’s Andariel unit, for facilitating an IT worker scheme that used falsified identities and nationalities to obtain employment at unwitting companies. The activity involved DPRK nationals working from China, Russia, and other locations, using stolen U.S. personal information, proxy accounts, aliases, and forged documents to pose as remote job applicants. Treasury warned that DPRK IT workers target technology and virtual currency firms, may introduce malware into employer networks, and use exchanges or trading platforms to manage, launder, and remit proceeds to North Korea. The designations also covered Gayk Asatryan and companies tied to Russia-based arrangements to dispatch DPRK IT workers, showing how cyber-enabled revenue generation supports sanctions evasion and weapons funding.