Song Kum Hyok 송금혁 confirmed
Actor-cluster tags
Photo
No verified public image available.
Sanctions-designation details
Status: Designated by OFAC on July 8, 2025 under Executive Order 13694 as amended, program tag CYBER4, as a malicious cyber actor associated with the Reconnaissance General Bureau hacking group Andariel
| Location | Changbailu No. 55, Yanji, Jilin 133000, China; North Korea |
|---|---|
| Date of Birth | August 30, 1987 |
| Nationality | North Korean |
| Sex | Male |
| Email address, per OFAC | wangge327@yahoo.com |
Caution
Song is a DPRK-based cyber actor who used foreign-hired IT workers to seek remote employment with U.S. companies and planned to split income with them.
Song is a DPRK-based cyber actor who used foreign-hired IT workers to seek remote employment with U.S. companies and planned to split income with them. In 2022 and 2023, Song used U.S. persons’ information, including names, social security numbers, and addresses to create aliases for the hired foreign workers. The workers then used the accounts to pose as U.S. persons looking for remote jobs with U.S. companies.
Sources
Every factual claim on this page is drawn from the public records listed below.
- Recent Actions, July 8, 2025: Cyber-related and North Korea Designations (Song Kum Hyok, Gayk Asatryan, Asatryan LLC, Fortuna LLC, Korea Songkwang Trading, Korea Saenal Trading) — U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC), 2025-07-08 sanctions designation
- Sanctions Imposed on DPRK IT Workers Generating Revenue for the Kim Regime — U.S. Department of the Treasury, 2025-07-08 press release
- 미국, 북한 해킹조직 안다리엘 소속 해커 '송금혁' 제재 (United States sanctions Song Kum Hyok, a hacker with the North Korean group Andariel) — Daily Secu, 2025-07-11 reference