US sanctions supporters of North Korean hackers, Iranian cyberspace head

The U.S. government on Monday took action against three people accused of helping launder funds stolen by North Korean state hackers, as well as the head of the bureau that governs Iranian cyberspace.

According to a federal indictment, Sim Hyon Sop — a North Korean Foreign Trade Bank representative — conspired with three people to launder stolen cryptocurrency and to purchase goods through Hong Kong-based front companies on behalf of the North Korean government. The Justice Department charged him with conspiring to launder monetary instruments.

He and two of his alleged co-conspirators, China-based Wu Huihui and Hong Kong-based Cheng Hung Man, were also added to a sanctions list on Monday by the Treasury Department. The Treasury accused them of supporting the Lazarus Group — a cybercriminal gang within the North Korean government — by facilitating the conversion of virtual stolen cryptocurrency into fiat currency.

Wu allegedly processed millions of dollars’ worth of virtual currency on behalf of North Korean cyber actors in 2021. Separately, Wu was indicted on Monday for allegedly operating without a license as a digital currency trader on a U.S.-based exchange.

Cheng, meanwhile, allegedly worked with Wu and others to convert virtual currency for the North Korean government. He is accused of using front companies to “bypass illicit financing requirements and access the U.S. financial system,” the Treasury said.

North Korea directly threatens international security by using “illicit facilitation networks to access the international financial system and generate revenue using virtual currency for the regime’s unlawful weapons of mass destruction (WMD) and ballistic missile programs,” said Brian E. Nelson, undersecretary of the Treasury for terrorism and financial intelligence, in the release.

In a separate indictment, Sim is also accused of laundering money from North Korean IT workers employed by U.S. cryptocurrency companies who disguised their identities in order to get hired.

According to the Treasury, in 2022 North Korean hackers stole $1.7 billion in virtual currency, a significant boon to an economy largely cut off from international commerce.

Iranian official

Also on Monday, the Treasury’s Office of Foreign Assets Control included the secretary of Iran’s Supreme Council of Cyberspace (SCC), which governs usage of the internet, on a sanctions list targeting people involved in the violent suppression of recent protests in the country.

According to OFAC, Seyyed Mohammad Amin Aghamiri’s bureau is “responsible for Iran’s blockage of popular online news and communications platforms and has also used digital technology to spy on and harass journalists and regime dissidents.”

In response to the protests last fall, the Iranian government blocked Instagram and WhatsApp, restricted internet access, and surveilled civilians.

The targets of OFAC sanctions are not allowed to do business or hold property in the U.S., nor is business allowed to be conducted with them from within the U.S.

In many cases, the sanctions are largely symbolic, given that people connected with North Korea or the Iranian government are unlikely to have economic ties with the West.