U.S. Indicts Five Over North Korea’s Illicit IT Workforce Scheme

Multi-Year Scheme Exposed, Targeting U.S. Companies

U.S. authorities have indicted 5 individuals for their involvement in a scheme that used remote IT work to funnel money to North Korea. The Department of Justice (DOJ) announced the indictment on Thursday, naming North Korean nationals Jin Sung-Il and Pak Jin-Song, Mexican national Pedro Ernesto Alonso De Los Reyes, and US citizens Erick Ntekereze Prince and Emanuel Ashtor.

Sophisticated Tactics Uncovered

FBI investigation found out that Ntekereze and Ashtor operated a “laptop farm” in North Carolina, using company laptops to create the illusion of US based employees. Remote access software, Anydesk and TeamViewer, was installed to hide the location of the North Korean operatives. Forged US ID and bank accounts were provided to Jin and Pak to hide the operation.

Wide-Reaching Impact

64 US companies were affected, including financial institutions, tech companies and IT companies. Ten companies paid $866,255, most of which was laundered through Chinese banks.

DOJ and FBI Respond

“The Department of Justice will continue to disrupt North Korea’s cyber-enabled sanctions-evasion schemes that trick US companies into funding the North Korean regime’s priorities, including its weapons programs,” said Devin DeBacker, DOJ official.

FBI also issued an advisory warning US companies of the growing threat from North Korean IT workers. This operation involved data exfiltration, cybercrime, and generating revenue for the North Korean regime.

Global Efforts to Combat Cybercrime

The indictment comes after US Treasury Department sanctioned individuals and entities for similar activities. Alonso was arrested in the Netherlands on a US arrest warrant, while Ntekelese and Asutol were arrested in the US.

DOJ and FBI’s actions show ongoing efforts to go after North Korea’s IT operations and protect US companies from cyber threats. While the investigation continues, companies are advised to strengthen their cybersecurity and be vigilant about these plans.