You Won’t Believe Who’s Coding for Kim: North Koreans, Russians, Crypto, and Chaos!

by

The U.S. Treasury is at it again! That’s right, folks, they’ve put the kabosh on two dastardly characters and four entities for playing “Where in the World is North Korea’s IT Worker?” Spoiler: They were right under our noses, snooping through crypto companies! 🕵️‍♂️💻

First up: Song Kum Hyok, a North Korean national with more secret connections than a New York City subway map. This guy’s linked to the Reconnaissance General Bureau (think: North Korea’s version of Bond villains), and their cybercrime side hustle, Andariel. Song’s idea of a good time? Swiping U.S. citizen info, creating fake IDs, and handing out remote IT jobs to his buddies, mostly in crypto firms. I mean, it’s an employment agency and an episode of “Catch Me If You Can,” all rolled into one! 🎭

Naturally, there’s a split: Song grabs his cut, and the rest is funneled back to buy…well, “stuff you don’t sell on eBay.” Weapons! This is North Korea, not Vegas.

From Russia with love (or at least paperwork): Gayk Asatryan! You get some LLCs, you get some LLCs—everybody gets an LLC! Asatryan LLC and Fortuna LLC are the kind of companies that hire dozens of North Korean IT workers to code away for Kim Jong Un’s piggy bank. If you thought remote work was just about pajamas, think again! 🛌🤑

Two North Korean companies are in the mix, too: Korea Songkwang Trading Corporation and Korea Saenal Trading Corporation. Their business model? Think “Uber,” except the drivers are hackers, and instead of cars, you’re dispatching workers to wire money home.

OFAC (that’s the Office of Foreign Assets Control, or as I call them, the Fun Police) says this is all part of North Korea’s latest “IT Worker Vacation Adventure,” operating mostly out of China and Russia. Their resume skills: Photoshop, Python, and pretending to be Nancy from Nebraska. 😅

Once in your crypto start-up, these folks use freelance platforms and crypto exchanges to beam the bucks straight back to Pyongyang. They use fake names, fake mustaches, whatever it takes—if only Hollywood cast them, “Mission: Impossible” could finally have some realism!

The Treasury claims these workers are world-class at hiding who they are—proxy accounts here, fake identities there, “Hi, I’m Bob from Boise!” Meanwhile, they’re washing crypto so fast, you’d think it’s laundromat night. 🚿🪙

The old hack-and-dash approach is passé. Now it’s all about social engineering—a fancy way to say, “con your way into a tech job, cash the checks, keep the missiles flying.” Even the crypto investigation whiz ZachXBT estimates close to 920 North Korean IT workers slipped right past HR, racking up $16 million in payroll. Talk about a performance bonus!

So, with the stakes high and Kim Jong Un’s new Macbook Pro in the balance, the U.S. authorities are “cleaning house.” The Justice Department is bringing charges, seizing crypto, and making sure next time North Korea sends a job application, it goes right into the spam folder.

Read More

2025-07-09 10:06