25cr10273_ind_redacted.pdf (5 MB)

The Justice Department announced coordinated U.S. actions against DPRK remote IT worker revenue schemes, including two indictments, one arrest, searches of 29 suspected laptop farms across 16 states, and seizures of 29 financial accounts and 21 fraudulent websites. Court documents allege North Korean workers used stolen or fake identities to obtain remote IT jobs at more than 100 U.S. companies with assistance from facilitators in the United States, China, the United Arab Emirates, and Taiwan. The schemes relied on front companies, fraudulent websites, U.S.-hosted laptops, KVM devices, and shell-company financial accounts to make overseas workers appear locally based and route payments onward. The activity exposed employers to sensitive-data theft, including ITAR-controlled defense technology, and one charged scheme involved the theft of more than $900,000 in virtual currency from blockchain companies.