Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

On November 30, 2023, the U.S. Treasury Department announced sanctions against eight foreign-based North Korean agents and the Kimsuky cyber espionage group. Treasury said the two designation tracks addressed different activities: the agents allegedly supported arms sales, financial transfers, procurement, or revenue generation, while Kimsuky gathered intelligence for North Korea. The announcement was coordinated with Australia, Japan, and the Republic of Korea and followed North Korea’s claimed November 21 reconnaissance satellite launch.

What Treasury announced

The Treasury Department’s Office of Foreign Assets Control (OFAC) announced the designations on November 30, 2023. Treasury said the action was intended to hinder North Korea’s ability to generate revenue, procure materials, and gather intelligence that it said supported weapons of mass destruction development and unlawful arms exports. The department linked the timing to North Korea’s November 21 claimed military reconnaissance satellite launch.

Treasury’s account describes two related but distinct tracks—not eight people accused of hacking. One covers eight overseas agents Treasury associated with weapons exporters, financial institutions, and front companies. The other targets Kimsuky, which Treasury characterized as an intelligence collection group. The announcement cited different executive orders for the named individuals and the group. Treasury’s November 30, 2023 release is the primary source for the government’s stated rationale and allegations.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Treasury Under Secretary for Terrorism and Financial Intelligence Brian E. Nelson said: “Today’s actions by the United States, Australia, Japan, and the Republic of Korea reflect our collective commitment to contesting Pyongyang’s illicit and destabilizing activities,” according to the release.

Who were the eight foreign-based agents?

Treasury connected the eight individuals to Green Pine Associated Corporation, the Foreign Trade Bank of the DPRK (FTB), Koryo Commercial Bank (KCB), Korea United Development Bank (KUDB), or the Mansudae Overseas Project Group of Companies (MOP). The following roles and conduct are Treasury’s descriptions in the 2023 announcement, not independently established findings.

Three Green Pine representatives

  • Kang Kyong Il and Ri Sung Il: Treasury identified both as Green Pine representatives based in Tehran. It said Kang attempted to sell Chinese-origin aluminum, while Ri worked with other North Korean representatives to sell conventional weapons to foreign governments. Treasury also said the two had traveled together to China multiple times.
  • Kang Phyong Guk: Treasury identified him as a Beijing-based Green Pine representative and a central liaison between Green Pine and its overseas representatives.

Treasury estimated that Green Pine was responsible for approximately half of North Korea’s arms and related materiel exports. That is the department’s estimate in the release, not an independently verified figure here.

Three financial representatives

  • So Myong: Treasury identified him as FTB’s chief representative in Vladivostok, Russia, and said he facilitated financial transfers for designated North Korean financial institutions and weapons-trading entities.
  • Choe Un Hyok: Treasury identified him as a KUDB representative in Russia and said he coordinated multiple payments to an entity subordinate to the Munitions Industry Department.
  • Jang Myong Chol: Treasury identified him as a KCB representative in China and said he facilitated transactions worth hundreds of thousands of dollars.

Two MOP-related representatives

  • Choe Song Chol and Im Song Sun: Treasury said they represented MOP front companies and generated revenue for North Korea through the export of North Korean workers.

What Treasury said Kimsuky did

Treasury described Kimsuky as active since 2012 and subordinate to North Korea’s Reconnaissance General Bureau (RGB), which the department called the country’s primary foreign intelligence service. Treasury also said related activity is known in cybersecurity circles by the names APT43, Emerald Sleet, Velvet Chollima, TA406, and Black Banshee.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The department characterized Kimsuky primarily as an intelligence collection entity whose campaigns support North Korean strategic and nuclear ambitions. It said the group used spear-phishing and social engineering to seek illicit access to private documents, research, and communications. Treasury listed targets employed by governments, research centers, think tanks, academic institutions, and news media in Europe, Japan, Russia, South Korea, and the United States. It said the intelligence sought concerned geopolitical events, foreign-policy strategies, and diplomatic efforts.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What the sanctions mean under Treasury’s release

Treasury said property and interests in property belonging to designated persons are blocked when they are in the United States or in the possession or control of U.S. persons, and must be reported to OFAC. The release also described an ownership rule: an entity owned directly or indirectly 50 percent or more by one or more blocked persons is itself blocked.

Under the release’s summary, U.S. persons and transactions within or transiting the United States are generally prohibited from dealing in blocked persons’ property interests unless authorized by a general or specific license or otherwise exempt. This explains the effect Treasury described in 2023; it does not establish any person’s or entity’s current sanctions-list status or account for later changes to regulations, licenses, or exemptions. For a present-day compliance question, consult current OFAC records and guidance rather than relying on the dated announcement alone.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.