Cyber Security News

US Announces $15M Reward for North Korean IT Scheme Leaders

The United States government announced coordinated actions across multiple departments today, offering rewards totaling up to $15 million for information leading to the arrests and convictions of North Korean nationals involved in extensive revenue generation schemes targeting American companies and citizens.

The Department of State’s Transnational Organized Crime Rewards Program is specifically targeting Sim Hyon-sop and six co-conspirators who orchestrated illicit activities designed to fund North Korea’s weapons of mass destruction and ballistic missile programs.

These criminal enterprises include cryptocurrency theft, fraudulent IT work, counterfeit goods trafficking, and oil smuggling operations that directly threaten U.S. homeland security.

Reward Structure and Key Targets

The reward distribution reflects the severity of each individual’s involvement in these schemes. Sim Hyon-Sop, identified as a primary organizer, carries the highest bounty of up to $7 million.

Myong Chol-Min and Kim Se-Un each have rewards of up to $3 million, while Kim Yong-Bok, Kim Chol-Min (also known as “Jack”), Ri Tong-Min (also known as “Elvis”), and Ri Won-Ho each carry rewards of up to $500,000.

The charges against these individuals stem from their involvement in tobacco trafficking operations designed to generate U.S. dollar access for North Korea.

Additionally, several conspirators, including Kim Se-Un, participated in fraudulent IT worker schemes that have become increasingly sophisticated and widespread.

North Korea has deployed thousands of IT workers abroad, primarily operating from Russia and China, to conduct fraudulent remote work for American companies.

These workers specifically target high-paying remote positions with U.S. corporations, including Fortune 500 companies, remitting their earnings back to North Korea to support banned weapons programs.

The Treasury Department simultaneously designated Korea Sobaeksu Trading Company, which previously deployed IT workers to Vietnam, along with three North Korean nationals involved in these revenue generation schemes.

These networks provide North Korea with crucial access to technology and financial systems that support sanctioned entities including the Munitions Industry Department and Ministry of Atomic Energy and Industry.

In a related case, American citizen Christina Marie Chapman is scheduled for sentencing today in the District of Columbia for her role in a North Korean IT worker scheme that defrauded more than 300 U.S. companies.

This case demonstrates how North Korean operatives recruit accomplices to facilitate their fraudulent activities on American soil.

The government emphasized that these ballistic missiles funded through such schemes have been unlawfully transferred to Russia and used to strike Ukrainian territory, including Kyiv, highlighting the international security implications of these criminal networks.

Get Free Ultimate SOC Requirements Checklist Before you build, buy, or switch your SOC for 2025 - Download Now

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups

Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…

1 day ago

Anthropic’s Claude AI Uncovers Origins of NSA-Provided Cryptographic Keys After 25 Years

Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…

1 day ago

Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication

Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…

1 day ago

OpenBSD Kernel Flaw Dating Back 37 Years Enables Local Privilege Escalation to Root

A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…

1 day ago

GhostAction Hackers Hide Credential-Stealing Malware in Fake Font Files Across 94 GitHub Repositories

GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…

1 day ago

SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data

Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…

1 day ago