US Treasury sanctions three North Korean state-sponsored hacking groups, Lazarus, Bluenoroff, and Andarial; Lazarus was responsible for WannaCry ransomware
This September 2019 designation is the opening move in what became a sustained Treasury campaign against Pyongyang's cyber apparatus: by formally naming Lazarus, Bluenoroff, and Andarial as sanctioned state-sponsored groups, the US gained legal authority to freeze and seize any assets touching them — and pinned WannaCry on Lazarus as a matter of official record.
Everything since flows from that template: Treasury later went after two Chinese nationals accused of laundering Lazarus's crypto hauls (2020), tied the group to the Ronin bridge theft of over $600M, took down the Sinbad mixer it allegedly relied on (2023), and by 2025 was sanctioning individual officials running North Korea's illicit IT-worker placement schemes.
First-order effects
Any bank, exchange, or contractor holding or processing funds linked to the three groups now faces seizure risk, converting prior attributions like WannaCry into actionable financial penalties rather than just public shaming.
Lazarus, Bluenoroff, and Andarial lose access to the Western financial system by name, forcing their operators to route proceeds through intermediaries who now carry the legal exposure.
Second-order effects
The laundering layer becomes the pressure point: once the groups themselves are named, enforcement shifts to the Chinese nationals and regional brokers who convert stolen cryptocurrency into usable currency — the pattern Treasury followed in its 2020 action.
Crypto services face a compliance reckoning, since any mixer or exchange touching Lazarus proceeds becomes a sanctions target itself, as the later Sinbad seizure demonstrated.
Third-order effects
If the sequence holds, sanctions doctrine matures from designating hacking units to dismantling an entire state revenue chain — hackers, launderers, mixers, IT-worker fronts, and finally named officials — treating North Korean cybercrime as a finance problem rather than a purely counterintelligence one.
The trend: US financial enforcement against North Korea is expanding from naming its hacker groups to systematically severing every downstream channel that turns stolen crypto and illicit labor into regime revenue.
It's good that the US has sanctioned North Korean hackers. Now they won't be able to steal money from banks because that would violate sanctions and thus be illegal. https://arstechnica.com/...
The U.S. Treasury Department has sanctioned three North Korean groups accused of conducting cyberattacks on behalf of Pyongyang to generate revenue for its nuclear and missile programs. https://www.trunews.com/...
The U.S. Treasury Dept is sanctioning 3 North Korean hacking groups it says are backed by KJU, including Lazarus Group and 2 of its subgroups Bluenoroff and Andariel. They support Pyongyang's illicit weapon/missile programs. Details on @CyberScoopNews https://www.cyberscoop.com/.…
A tidbit to pull out today w new NK sanctions: Cybercom talks about how enabling is a part of DOD “defending forward,” and @CyberScoopNews has reported on how Cybercom works with DHS before - today we see this part of defend forward with Treasury/OFAC too https://www.cyberscoop.c…
There was a lot of weak sauce gripes coming from the INFOSEC industry about the malware drops in VirusTotal by @CNMF_VirusAlert on Sunday. However, as mature professionals have suggested, it was one act in the execution of a greater strategy. https://home.treasury.gov/... https:/…
North Korean Cyber Sanctions by @USTreasury. Groups that @CrowdStrike tracks as SILENT CHOLLIMA and STARDUST CHOLLIMA, attributed by USG to RGB intelligence agency. On the heels of @USCYBERCOM DPRK malware release this weekend https://home.treasury.gov/... https://www.hybrid-anal…
Treasury sanctions hackers behind Lazarus Group, widely attributed to North Korea — the same hackers who allegedly launched WannaCry and behind the Sony hacks. https://home.treasury.gov/... https://twitter.com/...
US Treasury sanctions three North Korean hacking groups -US wants to seize financial assets associated with Lazarus Group, Bluenoroff, Andarial -directly accuses the Pyongyang regime of carrying out hacks to raise money for its nuclear missile programs https://www.zdnet.com/... h…