...
By Monica Sager and Gabe Whisnant
0
Share
Newsweek is a Trust Project member
See more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.
The United States Department of Justice (DOJ) announced the indictment of two North Korean nationals and three facilitators, including two Americans, involved in a multiyear fraudulent scheme to secure remote information technology (IT) work from U.S. companies.
Why It Matters
Over the last few years, U.S. agencies have uncovered efforts by North Korea to have their citizens employed by American companies. Higher-paying IT salaries can often be filtered back to the government, allowing North Korea access to sensitive information.
Read More on U.S.
The Justice Department said North Korea has sent "thousands" of IT workers to China, Russia and Southeast Asia, as well.
This is not the first time a North Korean group has infiltrated U.S. companies remotely. In May 2024, a woman was accused of helping North Koreans gain freelance IT employment at U.S. companies. In August, a U.S. citizen was charged with aiding North Korean actors in obtaining remote IT work and laundering their salaries to finance the country's weapons program. Last week, the U.S. sanctioned two North Korean nationals as well as several companies in Laos and China for their IT worker schemes.
The DOJ launched a "DPRK RevGen: Domestic Enabler Initiative" in March 2024 to identify and shutter this type of practice.
...
What To Know
The indicted North Korean nationals, Jin Sung-Il and Pak Jin-Song, orchestrated the scheme, while Mexican national Pedro Ernesto Alonso De Los Reyes and Americans Erick Ntekereze Prince and Emanuel Ashtor provided essential support, a press release from the DOJ stated.
The facilitators helped create false identities and fabricated resumes, enabling the North Koreans to apply for and obtain remote IT jobs under false pretenses.
The DOJ said they successfully infiltrated the U.S. job market by concealing their true identities and locations, thereby circumventing security protocols intended to protect sensitive data and infrastructure.
According to the indictment, the scheme occurred between April 2018 and August 2024. The con-conspirators obtained work from at least 64 U.S. companies. Payments from 10 companies equated to at least $866,255, most of which were laundered through a Chinese bank account.
In addition to the indictments on Thursday, the FBI released an advisory around data extortion and infiltration.
"FBI is warning the public, private sector, and international community about North Korean IT workers' continued victimization of US-based businesses. In recent months, in addition to data extortion, FBI has observed North Korean IT workers leveraging unlawful access to company networks to exfiltrate proprietary and sensitive data, facilitate cyber-criminal activities, and conduct revenue-generating activity on behalf of the regime," the statement read.
What Is A Laptop Farm?
Ashtor was running a "laptop farm" in his North Carolina residence.
These farms are locations where multiple computers can connect to the internet on the same network. People at the laptop farm help those who are remote with logging on to the computers. It then appears that the remote people are working at the host "farm" location and can more easily avoid suspicions while concealing their identities.
In this case, the laptop farm hosted victim company-provided laptops to deceive companies into thinking they had hired US-located workers, according to the DOJ.
What People Are Saying
Daniel Salisbury, an associate fellow at the Royal United Services Institute and a senior research fellow at the Department of War Studies at King's College London, previously told Newsweek: "The DPRK has long used overseas workers to raise revenue which has likely been channeled to its WMD efforts. Often, this labor has involved more traditional jobs such as working in Chinese factories, Russian logging camps, on overseas construction projects or in DPRK restaurants overseas."
Supervisory Official Devin DeBacker of the Justice Department's National Security Division, in a press release: "The Department of Justice remains committed to disrupting North Korea's cyber-enabled sanctions-evading schemes, which seek to trick U.S. companies into funding the North Korean regime's priorities, including its weapons programs. Our commitment includes the vigorous pursuit of both the North Korean actors and those providing them with material support. It also includes standing side-by-side with U.S. companies to not only disrupt ongoing victimization, but also to help them independently detect and prevent such schemes in the future."
Assistant Director Bryan Vorndran of the FBI's Cyber Division, in a press release: "FBI investigation has uncovered a years-long plot to install North Korean IT workers as remote employees to generate revenue for the DPRK regime and evade sanctions. The indictments announced today should highlight to all American companies the risk posed by the North Korean government. As always, the FBI is available to assist victims of the DPRK. Please reach out to your local FBI field office should you have any questions or concerns."
What's Next
The FBI have arrested Ntekereze and Ashtor. The agency also searched Ashtor's residence in North Carolina. Alonso was arrested in the Netherlands on January 10.
The FBI Miami Field Office is investigating the case.
Update 1/23/25, 5:44 p.m. ET: This article was updated with additional information.
View 0 Comments
Submit Correction
View Editorial & AI Guidelines