US brings charges in North Korean remote worker scheme that officials say funds weapons program

WASHINGTON (AP) — The Justice Department announced criminal charges Monday in connection with a scheme by North Korea to fund its weapons program through the salaries of remote information technology workers employed unwittingly by U.S. companies.

The charges are part of what law enforcement officials described as a nationwide operation that also resulted in the seizure of financial accounts, websites and laptops that were used to carry out the fraud.

Two separate cases — one filed in Georgia, the other in Massachusetts — represent the latest Justice Department effort to confront a persistent threat that officials say generates enormous revenue for the North Korean government and in some cases affords workers access to sensitive and proprietary data from the corporations that hire them.

The scheme involves thousands of workers who, armed with stolen or fake identifies of U.S. citizens, are dispatched by the North Korean government to find work as remote IT employees at American companies, including Fortune 500 corporations. Though the companies are duped into believing the workers they had hired were based in the U.S., many are actually stationed in North Korea or in China and the wages they receive are transferred into accounts controlled by co-conspirators affiliated with North Korea, prosecutors say.

“These schemes target and steal from U.S. companies and are designed to evade sanctions and fund the North Korean regime’s illicit programs, including its weapons programs,” Assistant Attorney General John Eisenberg, the head of the Justice Department’s National Security Division, said in a statement.

In one case exposed on Monday in federal court in Massachusetts, the Justice Department said it had arrested one U.S. national and charged more than a half dozen Chinese and Taiwanese citizens for their alleged roles in an elaborate fraud that prosecutors say produced at least $5 million in revenue and affected more than 100 companies.

The defendants are accused of registering financial accounts to receive the proceeds and creating shell companies with fake websites to make it appear that the workers were connected to legitimate businesses. They also benefited from the help of unidentified enablers inside the United States who facilitated the workers’ remote computer access, tricking companies into believing the employees were logging in from U.S. locations.

The Justice Department did not identify the companies that were duped, but said that some of the fraudulent workers were able to gain access to and steal information related to sensitive military technology.

The case filed in Georgia charges four North Korean nationals with using fake identities to gain access to am Atlanta-based blockchain research and development company and stealing hundreds of thousands of dollars in virtual currency.

The Justice Department has filed similar prosecutions in recent years, as well as created an initiative aimed at disrupting the threat.