US Treasury sanctions 10 North Koreans and Russians over IT worker fraud scheme
The US Treasury's Office of Foreign Assets Control sanctioned 10 individuals and entities tied to North Korea's IT worker scheme, which it says funds weapons programs. CBS reports Russia-based facilitators among them; Just the News quotes Secretary Scott Bessent.
1 / 2
The story, neutrally told
Mixed · 2On Wednesday 28 October 2026 the US Treasury Department's Office of Foreign Assets Control (OFAC) imposed sanctions on 10 people and entities linked to North Korea's IT worker fraud operation. CBS NewsLC “The Treasury Department has sanctioned 10 North Koreans and Russians powering Pyongyang's sprawling IT worker fraud enterprise” Read at CBS News ↗ Just the NewsRC “is imposing new sanctions on 10 North Korean individuals for their roles in information technology worker schemes that defraud U.S. businesses” Read at Just the News ↗ Mixed · 2In the scheme, North Korean operatives use stolen identities, fake résumés and fake personas to pose as legitimate IT professionals, win jobs at US and allied companies, and send most of their pay to the state, which Treasury says funds weapons of mass destruction and ballistic missile programs. CBS NewsLC “North Korean operatives pose as legitimate IT professionals, secure jobs at unwitting U.S. and allied companies, and funnel the majority of their pay back to the regime.” Read at CBS News ↗ Just the NewsRC “It then uses most of the wages from the workers to fund its programs.” Read at Just the News ↗ Mixed · 2CBS News reports that once inside corporate networks the workers can also access sensitive data, deploy malware and extort employers; Treasury Secretary Scott Bessent, quoted by Just the News, said they "weaponize sensitive data and extort businesses for substantial payments." CBS NewsLC “these workers can also access sensitive data, deploy malware and even extort their employers” Read at CBS News ↗ Just the NewsRC “who weaponize sensitive data and extort businesses for substantial payments” Read at Just the News ↗
Left · 1According to CBS, investigators found key parts of the machinery operating in Russia. Those designated include Russian national Vitold Viktorovich Obertas, an intermediary who since January 2025 has processed nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency transactions for North Korean officials. CBS NewsLC “Among those designated Wednesday is Russian national Vitold Viktorovich Obertas, an intermediary who has facilitated financial transactions for North Korean officials.”“Since January 2025, Obertas has processed nearly $2 million in cryptocurrency conversions and at least $1.25 million in additional currency transactions for DPRK officials.” Read at CBS News ↗ Left · 1OFAC also sanctioned North Korean national Kim Ki Hyok, who leads an IT worker delegation in Russia and has transferred nearly $500,000 in cryptocurrency on its behalf since 2024, and the Russia-based, North Korean-controlled First Financial and Technical Development Center, designated along with six of its operatives. CBS NewsLC “Kim Ki Hyok, who leads an IT worker delegation in Russia”“Six of its own operatives were designated alongside the organization.” Read at CBS News ↗ Left · 1All US-linked property of the designated persons is blocked, and Americans are generally prohibited from dealing with them. CBS NewsLC “All U.S.-linked property and interests in property of the designated persons have now been blocked, and Americans and U.S. residents are generally prohibited from engaging with them.” Read at CBS News ↗
Right · 1Treasury said the action targets key facilitators and financial networks that move proceeds for the North Korean government, including through cryptocurrency, money laundering and emerging technologies. Just the NewsRC “The department said the new actions target key facilitators and financial networks that help sustain the schemes and move illegal proceeds on behalf of the North Korean government.”“sophisticated cryptocurrency transactions, money laundering techniques and emerging technologies” Read at Just the News ↗ Mixed · 2Just the News says the step expands on an earlier designation of a separate North Korean IT worker network that allegedly generated nearly $800 million for North Korea in 2024; CBS puts the latest proceeds at hundreds of millions of dollars. Just the NewsRC “which allegedly generated nearly $800 million for North Korea in 2024” Read at Just the News ↗ CBS NewsLC “The hundreds of millions of dollars in proceeds are then used to fund North Korea's weapons of mass destruction and ballistic missile programs.” Read at CBS News ↗
Every sentence links to the reporting it rests on. The pill in front of each says where its sources sit: Left, Centre or Right when one side supplies at least half of them, Mixed when they are evenly split. The number is how many outlets it cites.
Left1 outlet
- Framing
- Detailed enforcement story focused on the Russian side of the network, with named targets and dollar figures.
- Emphasis
- Named designees, crypto amounts, Russia-based facilitators, and the blocking of property.
- Leaves out or plays down
- No quote from Bessent and no mention of the earlier $800 million network.
- Charged language
- “sprawling IT worker fraud enterprise”“machinery”
- For example
-
“investigators discovered key parts of that machinery operating in Russia” — CBS News
Centre0 outlets
No centre outlet in our sources has covered this story yet.
Right1 outlet
- Framing
- Official-statement framing, led by Treasury's claim about weapons funding and Bessent's quote crediting President Trump's leadership.
- Emphasis
- Bessent's statement, Trump's leadership, and the link to a prior $800 million network.
- Leaves out or plays down
- Does not name the designees, mention Russia, or give transaction figures.
- Charged language
- “weaponize sensitive data”“North Korean regime”
- For example
-
“Under President Trump's leadership, Treasury will continue to use all available tools to protect U.S. businesses” — Just the News
What every side reports
- OFAC sanctioned 10 people and entities on 28 October 2026 over North Korea's IT worker scheme.
- The scheme uses fake identities to get jobs at real companies, and the proceeds are said to fund weapons programs.
- The sanctions are meant to disrupt the financial networks behind the scheme.
Where accounts differ
-
Who was sanctioned
- Left
- CBS describes the 10 as North Koreans and Russians, naming Obertas, Kim Ki Hyok and a Russia-based centre.
- Right
- Just the News describes them as 10 North Korean individuals and does not mention Russia.
Treasury Department organisation
Treasury says the North Korean government exploits American companies through IT workers, that proceeds fund its weapons programs, and that it will use all available tools against the schemes.
“Treasury will continue to use all available tools to protect U.S. businesses from these malicious activities” — Just the News
North Korea place
North Korea is presented as running a state-backed operation that sends IT workers abroad, with no response from Pyongyang in the coverage.
“a state-run operation that churns out stolen identities, fake résumés and fake IT employees” — CBS News
Left1 article
-
Treasury sanctions North Koreans, Russians over IT worker scheme
Neutral Detailed account of the designations, with a Russia angle and specific financial figures.
Centre0 articles
No coverage yet.
Right1 article
-
Treasury Department sanctions North Korean IT worker schemes for facilitating fraud on US businesses
Neutral Relays Treasury's announcement and Bessent's quote, crediting Trump's leadership.
- 28 Oct 16:31 First CBS NewsLC Treasury sanctions North Koreans, Russians over IT worker scheme
- 29 Oct 01:12 +8h 41m Just the NewsRC Treasury Department sanctions North Korean IT worker schemes for facilitating fraud on US businesses
Times are when each article was published, or when we first saw it if the outlet gave no time.
Ask about this story
Loading…