North Korean worker fraud scheme sent nearly $1M to Pyongyang

Posted by author January 30, 2025 Jobs

North Korean worker fraud scheme sent nearly M to Pyongyang

Two North Koreans have been indicted for fooling American companies into hiring them for remote worker positions. The schemes aim to raise money for Pyongyang.

Five people, including two Americans, were indicted in a fraud scheme that aimed to put remote IT workers in U.S. companies so they could funnel hundreds of thousands of dollars to North Korea, the Department of Justice announced.

North Koreans Jin Sung-Il and Pak Jin-Song; Americans Erick Ntekereze and Emanuel Ashtor; and Mexican national Pedro Ernesto Alonso De Los Reyes were indicted on conspiracy charges relating to Ntekereze, Ashtor and Alonso providing assistance to Jin and Pak so they could get American jobs.

They funneled roughly $900,000 they raised between 2018 and 2024 to the coffers of North Korean leader Kim Jong Un, the Justice Department said. The people named in the federal indictment belong to a larger group of workers that got jobs more than 60 U.S. companies.

The case out of the Southern District of Florida is the latest in federal efforts to put a stop to North Korea remote worker fraud. The schemes have taken off in recent years, according to experts. American companies cannot hire nationals of the belligerent nation due to sanctions.

“Because of the pandemic and remote work they’ve had greater success in terms of the revenue-raising activity,” Scott Snyder, CEO of the Korea Economic Institute of America, said of North Korea. “The rise of remote work has given North Korea opportunities to impersonate legitimate IT workers.”

The five were indicted on several conspiracy charges: to commit wire and mail fraud; money laundering; and transfer of false identification documents, officials said. Jin and Pak are additionally charged with conspiracy to violate the International Emergency Economic Powers Act. They face up to 20 years in prison if convicted. They laundered the money through a Chinese bank.

The FBI arrested Americans Ntekereze and Ashtor, federal officials said. Alonso was arrested by authorities in the Netherlands on an arrest warrant from the U.S.

Jin and Pak are currently fugitives and their whereabouts are unknown.

Attorneys for the group could not be reached for comment.

Worker fraud a ‘cash cow’ for North Korea

Remote worker fraud schemes involve North Korean nationals posing as remote – often IT – workers. They depend on locals who hold onto their company computers at so-called laptop farms. Local collaborators give the North Koreans remote access to the computers so they appear local to American companies.

Illegal remote workers do the job they are hired for but the funds are funneled back to the isolated nation. Remote worker fraud schemes also open up American companies to other forms of cyberattack or theft, experts say.

The pandemic was a boon for such schemes, according to Korea expert Snyder.

North Korea sent thousands of skilled IT workers abroad with the hopes of landing jobs at American companies, according to the State Department. They look attractive to unwitting American companies but businesses hiring them also put themselves at risk.

“They’re knowledgeable, they’re capable and they’re doing the job plus more,” Snyder warned of the remote workers. “If you let someone like that onto your staff they can also plant malware and obtain backdoor access to your system.”

The schemes are low risk, high reward for the North Koreans workers, Snyder said, as they tend to work from countries outside the reach of American law enforcement. Typically, he said they work from countries friendly to Kim’s regime but with better internet infrastructure, namely China and Russia.

“This is a cash cow for North Korea,” Snyder said. “The return on investment still justifies in spades the effort that they’re making.”

Funds the workers raise likely go toward the regime’s arms programs, according to Snyder.

American collaborators

North Korean remote workers, including Pak and Jin, land jobs using forged American passports but at that point the schemes don’t work without U.S.-based collaborators.

That was Ntekerese and Ashtor’s role in the scheme, according to the indictment. The pair received laptops from the companies that hired Pak and Jin and then allowed the North Koreans to access the laptops remotely in order to appear as if they were locals. Ntekereze and Ashtor each received tens of thousands of dollars for their participation, the indictment says.

Mexican national Alonso is named in the indictment because he allowed Jin to use his identity to fool American companies.

It’s not clear from the indictment how the conspiracy initially came together. The U.S. Attorney’s Office for the Southern District of Florida declined to comment.

Ntekereze and Ashtor’s involvement went so far as registering companies that posed as staffing agencies to provide American companies with remote IT workers, court filings say.

The companies that unwittingly hired the North Koreans were a multinational retail corporation, a Connecticut-based financial institution, a Miami-based cruise line and a Silicon Valley tech company, according to the indictment.

Court filings say the North Koreans also did over $1 million in damages to the financial and tech firms.

Wanted: North Korean remote workers

The case out of the Southern District of Florida is just the latest in federal efforts to root out North Korean remote worker fraud.

A federal court in St. Louis, Missouri, indicted 14 North Korean nationals for remote worker fraud in December, according to the Department of Justice. The group brought in a whooping $88 million for the regime over the course of the six-year scheme, Justice officials said. The money came from the salaries they earned as well as stealing from the companies.

Authorities arrested a man in Nashville in August for operating a laptop farm for North Korea, federal officials said. Matthew Isaac Knoot, 38, ran the farm for about a year.

The Justice Department indicted three North Koreans and an Arizona woman in May for a “staggering fraud” scheme that involved using the identities of 60 Americans to bilk money from some 300 U.S. companies, including numerous well-known Fortune 500 companies, banks and other financial service providers, according to an indictment unsealed by the Department of Justice.