OFAC Sanctions Rwandan Defense Ministry Over M23 and 11 Facilitators of North Korean IT Worker Fraud

Treasury’s Office of Foreign Assets Control added 13 names to the SDN list on October 28 in two separate actions. Ten people and one company tied to North Korea’s overseas IT worker schemes were designated. So were Rwanda’s Ministry of Defence and a Rwandan savings society that pays for the army backing the M23 rebels in eastern Congo.

The two cases have nothing in common on the ground. What links them is the tool. Both rest on executive orders, both block any property under US jurisdiction, and both came out of Treasury on the same afternoon without a vote in Congress.

Image: US Department of the Treasury, public domain via Wikimedia Commons

The money behind North Korea’s remote workers

The larger batch goes after the people who move the pay. North Korean IT workers use stolen identities and fake personas to land remote jobs, including at US companies, and the regime keeps most of their wages. Treasury puts the total at hundreds of millions of dollars for Pyongyang’s weapons of mass destruction and ballistic missile programs. Some of the workers also plant malware and take company data once they’re inside.

Two Russians sit at the center of the list. Vitold Obertas is described as a go-between for North Korean officials, including for Amnokgang Technology Development Company, which OFAC designated on March 12. Since January 2025 he has run nearly $2 million in cryptocurrency conversions and at least $1.25 million in other currency deals for them. Ilya Boykov has handled about $3.5 million in crypto for Limited Liability Company Alis, a North Korean outfit OFAC designated in March 2024.

Two North Koreans run delegations of workers in Russia. Kim Ki Hyok leads the Alis team, makes sure its workers hit their revenue targets, and has moved close to $500,000 in crypto since 2024. Kim Hyo Dong runs a second team under the Chinyong Information Technology Cooperation Company, sanctioned in May 2023, and has handled more than $100,000.

The one entity is the First Financial and Technical Development Center, a North Korean operation based in Russia. Treasury says its workers use AI tools and layered crypto transfers, and that six of them have brought in more than $750,000 since 2025. The center was designated under Executive Order 13722 for exporting North Korean labor; the six workers were listed for supporting it. Everyone else falls under Executive Order 13687.

This lands two weeks after the Justice Department indicted 14 people and raided Texas laptop farms in the same kind of scheme. DOJ goes after the people who host the laptops in the United States. OFAC goes after the cash on its way out. Australia and the European Union made their own North Korea designations this month.

Rwanda and the Washington Accords

The second action is a sharper break with a partner. OFAC designated Rwanda’s Ministry of Defence under Executive Order 13413, the Congo sanctions order, for supporting the Rwanda Defence Force, which OFAC itself sanctioned on March 2. Treasury says the ministry directs thousands of troops in North and South Kivu who fight alongside M23 and supply it with weapons, logistics and training. It also says the army brought surface-to-air missiles and jamming gear into the area, a risk to civil aviation.

Zigama Credit and Savings Society was listed with it. Treasury says Zigama works for Rwanda’s security services, paid suppliers in China and elsewhere for the army’s weapons and ammunition, moved tens of millions of dollars for M23 and its political wing, and had a branch that helped carry gold from M23-held mines to Kigali.

M23 took Goma and Bukavu in early 2025 and controls gold mines in South Kivu and the Rubaya coltan area. The State Department flagged the minerals link in July 2024, since Rwanda’s exports have run above what its own mines produce.

What makes this one political is the deal behind it. The leaders of Congo and Rwanda signed the US-brokered Washington Accords for Peace and Prosperity on December 4, 2025, with a regional economic framework on trade and critical minerals attached. Secretary Scott Bessent framed the sanctions as the administration holding Rwanda to its commitments under that deal: stop backing M23 and pull its troops out of eastern Congo.

What the listings change

Any property of the 13 that is in the United States or held by US persons is now frozen and has to be reported to OFAC. Companies owned 50% or more by them are blocked too. US persons need a license to deal with any of them, and foreign banks that keep doing business with them risk secondary exposure.

The ministry listing will matter most outside Washington. A Defence Ministry on the SDN list is hard for any bank, supplier or donor with US ties to touch. For Kigali, staying inside the Accords now has a measurable price.

The North Korea side is a record that keeps growing. The Rwanda side is a test of whether a peace deal signed at the White House holds.

For the intelligence read on the same day’s list, see the k4i.com summary of the October 28 designations.