The EU and 11 countries support coordinated sanctions against North Korean IT worker networks and cooperation with Russia

A joint statement by the EU and 11 countries supports U.S., Australian, and European measures against networks through which North Korea obtains revenue from overseas labor, IT fraud, and cooperation with Russia. The United States sanctioned ten individuals and one entity on October 28, following decisions by Australia and the Council of the EU. Authorities attribute the financing of Pyongyang’s nuclear and ballistic programs to these networks. The statement does not adopt additional European sanctions.

The European Union and 11 partner countries announced on Wednesday, October 28, 2026, their support for coordinated sanctions targeting networks of North Korean workers abroad, cyber activities, and cooperation between Pyongyang and Moscow. The joint statement links the European measures of October 12 to those adopted by Australia on October 23 and to the new U.S. sanctions against ten individuals and one entity. According to the authorities, these networks generate revenue for North Korea’s nuclear and ballistic missile programs, including through the fraudulent employment of IT specialists by foreign companies. The statement does not constitute a new EU sanctions package.

In brief

1. The EU and 11 countries support the coordination of U.S., Australian, and European measures against networks through which North Korea obtains revenue from overseas labor, IT fraud, and cooperation with Russia. Each jurisdiction applies its own sanctioning instruments.

2. The United States listed ten individuals and one entity on October 28. Those targeted include two Russian intermediaries and six IT workers associated with a North Korean center in Russia. OFAC attributes more than $750,000 in cumulative revenue since 2025 to the six workers.

3. Australia sanctioned two individuals and two entities on October 23. The Council of the EU had added three individuals and four entities on October 12, bringing the European autonomous list for North Korea to 80 individuals and 25 entities.

4. The freezing or blocking of assets and trading prohibitions arise from each jurisdiction’s instruments. The amounts cited by the U.S. Treasury describe transactions or revenue attributed to those sanctioned, not funds already recovered or confiscated.

5. For companies recruiting remote IT personnel, authorities flag risks related to false identities, data theft, and extortion. The joint statement calls for the implementation of UN resolutions, without itself introducing additional European obligations for businesses.

The statement was published on behalf of Australia, Canada, France, Germany, Italy, Japan, the Netherlands, New Zealand, the Republic of Korea, the United Kingdom, the United States, and the European Union. The 12 parties support measures adopted during October by the EU, Australia, and the United States to prevent the financing of North Korean weapons programs and counter Russian-North Korean military cooperation, which they consider contrary to UN sanctions. Participation in the statement does not mean that all 11 countries simultaneously adopted new sanctions.

The U.S. measures of October 28 focus on IT worker networks. The U.S. Treasury’s Office of Foreign Assets Control, known as OFAC, states that these networks use forged documents, stolen identities, and fictitious profiles to obtain jobs at legitimate companies in the United States and allied countries. According to the agency, North Korean authorities take most of the salaries and use the revenue for weapons of mass destruction and ballistic missile programs.

The risk to employers goes beyond paying for services under a false identity. The Treasury states that North Korean workers have exploited access to company networks to install malicious software, extract sensitive data, and steal protected information. The agency also reports that businesses are being extorted through the use of data obtained in this way. These findings are attributed to U.S. authorities; inclusion on a sanctions list is a restrictive administrative measure, not a criminal conviction.

One of the sanctioned intermediaries, Russian national Vitold Viktorovich Obertas, allegedly carried out cryptocurrency conversions worth nearly two million dollars and other foreign-exchange transactions of at least 1.25 million dollars for North Korean officials beginning in January 2025. Another Russian national, Ilya Aleksandrovich Boykov, allegedly supported Alis through cryptocurrency operations equivalent to 3.5 million dollars beginning in 2024. Alis had already been sanctioned by the United States in March 2024. The figures indicate financial activities attributed to these intermediaries, not damages established by a court or confiscated sums.

The only newly designated entity in this action is First Financial and Technical Development Center (FFTDC), described by OFAC as a North Korea-controlled center located in Russia. According to the Treasury, the IT workers used by it generated several million dollars in revenue for the Pyongyang regime. Six workers associated with the center were sanctioned separately, with OFAC attributing more than $750,000 in cumulative revenue to them since 2025. These figures cover different scopes and reference periods and are not presented as a new total for the operation.

Under the U.S. regime, the property and property interests of designated persons located in the United States or in the possession or control of U.S. persons are blocked. The rule also applies to entities owned, directly or indirectly, individually or collectively, at least 50% by one or more blocked persons. Transactions by U.S. persons or transactions conducted in or through the United States involving such property are generally prohibited, subject to applicable authorizations and exceptions. These effects arise from U.S. rules and do not automatically transfer into EU law.

On October 23, Australia adopted targeted financial sanctions against two North Korean individuals and two entities that, according to the Canberra government, facilitate IT worker networks. The designated individuals are also subject to travel bans. Australia’s Department of Foreign Affairs explained that these workers obtain remote employment by claiming to be citizens of other countries and that the measures were coordinated with international partners, including the EU.

In the European Union, the Council had added three individuals and four entities to the autonomous sanctions list on October 12. The stated grounds concern support for nuclear and ballistic programs, evasion of UN sanctions, and intensified ties with Russia, including the deployment of North Korean workers, industrial cooperation, and arms and oil exchanges. Following this decision, the EU’s autonomous list comprises 80 individuals and 25 entities, in addition to the UN measures transposed into European law.

Those targeted by the EU include Ri Song Jin, a missile researcher and official whom the Council says was sent to Russia to support the use of North Korean missiles. The Russian real estate company Samolet Group and its chief executive, Anna Nikolaevna Akinshina, were also included in connection with the employment of North Korean workers on construction projects in Vladivostok. Other designations concern industrial projects and shipments of refined petroleum products from Russia to North Korea. The measures provide for the freezing of assets and a prohibition on making funds or economic resources available to listed persons or for their benefit; individuals are also subject to an EU travel ban.

The documentation cited by the partners comes from the Multilateral Sanctions Monitoring Team (MSMT), a mechanism created by 11 governments in October 2024 after Russia vetoed the extension of the UN panel of experts’ mandate. The MSMT is not a new Security Council body. Its first two reports analyzed military cooperation between Russia and North Korea and cyber and IT worker activities. The third, published on September 16, 2026, addresses the use of North Korean labor abroad to generate revenue, with a significant presence in China and Russia, according to information from participating states.

Security Council resolutions continue to apply after the mandate of the former panel of experts ended. Resolution 2397 of 2017 required the repatriation of North Korean workers earning income abroad, subject to applicable legal conditions, and tightened restrictions on oil supplies. In the October 28 statement, the partners call on all UN member states, especially the permanent members of the Security Council, to fully implement these resolutions and reaffirm the objective of the complete, verifiable, and irreversible denuclearization of North Korea.

For European businesses contracting IT services, the announcement brings to the forefront the verification of collaborators’ identities, protection of access to internal systems, and identification of payment beneficiaries. The change on October 28 consists of the new U.S. designations and multilateral support for coordinating measures, while companies’ concrete obligations remain those established by the sanctions regimes applicable to them.

https://2eu.brussels/ro/news/ue-si-11-tari-isi-coordoneaza-sanctiunile-impotriva-retelelor-nord-coreene-care-finanteaza-programele-militare-prin-fraude-informatice