US sanctions North Korean, Chinese nationals linked to Lazarus APT

US sanctions North Korean, Chinese nationals linked to Lazarus APT

The US authorities have imposed sanctions on several people said to have been involved in laundering cryptocurrency stolen by North Korean government hackers to support Kim's regime.

“The DPRK [the Democratic People’s Republic of Korea] launders stolen virtual currency and deploys information technology (IT) workers to fraudulently obtain employment to generate revenue in virtual currency to support the regime and its unlawful weapons of mass destruction and ballistic missile programs,” the US Treasury said in a statement.

The Treasury alleges that China-based trader Wu Huihui facilitated the conversion of virtual currency stolen by North Korea's Lazarus Group, a cybercrime syndicate responsible for a series of high-profile cyberattacks on financial, manufacturing, healthcare, publishing, media, entertainment, and international shipping companies, as well as government and military and critical infrastructure. Previously, the US authorities blamed Lazarus for the $600 Axie Infinity theft and the $100M Harmony hack.

The Hong Kong-based trader, Cheng Hung Man, worked with Wu to remit payments in exchange for virtual currency. Cheng used front companies to enable DPRK threat actors to bypass countering illicit finance requirements at financial institutions and access the US financial system, the statement said.

The Treasury also added to its sanctions blacklist Sim Hyon Sop, a representative of North Korea's Korea Kwangson Banking Corp, who recently relocated to Dandong, China. In his position with KKBC, Sim has coordinated millions of dollars in financial transfers for the DPRK.

According to the US Department of Justice, Sim was allegedly involved in laundering funds generated by North Korean IT workers who obtained illegal employment in the tech and crypto industry.

“These IT workers used fake personas to get jobs, including jobs at U.S.-based companies, and then asked to be paid in cryptocurrencies, such as stablecoins like USD Tether (USDT) and USD Coin (USDC), which are pegged to the US dollar. After receiving payment, they funneled their earnings back to North Korea through Sim,” the DoJ said.

The US sanctions freeze any US assets of the individuals and make those who do business with them also liable to sanctions.

Back to the list

Latest Posts

AI chatbots fall for phishing scams

AI chatbots fall for phishing scams

The models provided the correct URL only 66% of the time; nearly 30% of responses pointed users to dead or suspended domains.
3 July 2025
Chinese hackers exploited Ivanti flaws in attacks against French government

Chinese hackers exploited Ivanti flaws in attacks against French government

ANSSI believes that the Houken campaign is operated by ‘UNC5174’, an entity believed to act as an initial access broker for China’s Ministry of State Security.
2 July 2025
Threat actors exploit Vercel's AI tool v0 to build sophisticated phishing pages

Threat actors exploit Vercel's AI tool v0 to build sophisticated phishing pages

The malicious actors used v0.dev to create fake login pages mimicking legitimate brands.
2 July 2025