We review vendors based on rigorous testing and research but also take into account your feedback and our affiliate commission with providers. Some providers are owned by our parent company.
Learn more
vpnMentor was established in 2014 to review VPN services and cover privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: Holiday.com, ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.
Advertising Disclosure

vpnMentor was established in 2014 to review VPN services and cover privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: Holiday.com, ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.

U.S. Sanctions North Korean Hacker for IT Worker Scheme

U.S. Sanctions North Korean Hacker for IT Worker Scheme
Andrea Miliani Published on July 12, 2025 Cybersecurity Researcher

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned North Korean cyber actor Song Kum Hyok, a member of the hacking group Andariel, for his leading role in a large information technology (IT) worker scheme.

According to the official statement, Song recruited talents, including individuals from the Democratic People’s Republic of Korea (DPRK), in countries such as Russia and China, and provided falsified American IDs to help them secure high-paying remote positions for U.S. companies as IT workers.

A portion of the income generated by members of the scheme was funneled into North Korea’s weapons of mass destruction and ballistic missile programs. In some cases, the IT workers also installed malware in the networks of American companies.

“Song is a DPRK-based cyber actor who used foreign-hired IT workers to seek remote employment with U.S. companies and planned to split income with them,” states the document. “In 2022 and 2023, Song used U.S. persons’ information, including names, social security numbers, and addresses, to create aliases for the hired foreign workers.”

U.S. authorities noted that the DPRK IT group would target employers in wealthier countries and develop apps and software to target job positions, often projects that involved digital currency, to launder and transfer funds back to North Korea.

The OFAC issued an Executive Order holding Song accountable for his central role in the scheme and participation with the hacking group Andariel, also known as APT45 — the same group that exploited a VPN software update flaw in South Korea to install malware and steal information.

According to the New York Times, the U.S. government has been warning about the scheme since 2022, when the FBI issued an advisory warning. After that warning, North Korean workers began seeking jobs in other countries such as Germany, Britain, and Portugal.

In one case disclosed by U.S. authorities, a North Korean worker was using around 12 stolen American identities in 2024 to apply for positions at defense companies providing services to the U.S. government.

A few days ago, federal law enforcement conducted operations across 16 states, seizing financial accounts and websites, and searching for “laptop farms” — locations where the laptops delivered by the companies were stored to allow North Korean workers to access and work remotely.

About the Author

Andrea is a seasoned tech journalist with a growing passion for cybersecurity, covering cyberattacks, AI breakthroughs, and the latest trends shaping the future of technology.

Please, comment on how to improve this article. Your feedback matters!

Leave a comment

This field must contain more than 50 characters

The field content should not exceed 1000 letters

Sorry, links are not allowed in this field!

Name should contain at least 3 letters

The field content should not exceed 80 letters

Sorry, links are not allowed in this field!

Please enter a valid email address