DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

Argentina-based facilitator Antonia Doroganova’s Payoneer accounts for DPRK IT workers

Date (as written)
over a three-year period, as recently as early 2025
Year
2025
Country
Argentina
Actors (as written)
facilitator for Amnokgang and Ryugyong IT workers
Actor pages
facilitator for Amnokgang and Ryugyong IT workers
Tags (as written)
IT workers; facilitation; laundering
Dollar figures (as written)
more than $20 million; $20 million

Source entries (1)

Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025

Argentina-based facilitator Antonia Doroganova’s Payoneer accounts for DPRK IT workers · over a three-year period, as recently as early 2025
(MSMT/2025/2, report p. 86) “As recently as early 2025, an Argentina-based IT collaborator by the name of Antonia Doroganova created and maintained more than 20 Payoneer accounts used by two DPRK IT workers ... Over a three-year period, with activity as recently as early 2025, Doroganova facilitated the payment of more than $20 million in cryptocurrency to more than 15 cryptocurrency addresses, including through Binance, Bybit, and OKX exchanges, from DPRK actors and other sources.” (see Annex 18)
https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/pdfs/2025-10-22_MSMT-Report.pdf

Suggest a correction on GitHub