In a sophisticated scheme that mixes technology and economic espionage, fourteen North Korean citizens have been accused of using false identities to obtain jobs at American companies in the information technology sector, reported ABC News. These workers, operating remotely and under stolen identities, generated more than $88 million between 2017 and 2023, funds that were diverted to the government of North Korea. The proceeds obtained were used to finance programs to develop ballistic missiles and other weapons, in a clear violation of the international sanctions in force against the regime. Pyongyang.
The scheme involved both the use of stolen identities of US citizens and the involvement of local accomplices who facilitated fake interviews and connections. Wi-Fi. These methods, designed to evade the security controls of the contracting companies, put the integrity of the systems and sensitive data of the affected organizations at risk.
This case, described by authorities as “the tip of the iceberg,” highlights the complexity and scope of North Korean state-sponsored cybercrime operations.
The North Korean workers’ scheme not only sought to generate income through remote employment, but also compromised the security of the affected companies. On several occasions, employees used their access to steal sensitive information and subsequently extort money from their employers, demanding payments not to leak the stolen data.
Among the most sophisticated tactics, the use of Americans as “fronts” stands out. These accomplices participated in job interviews on behalf of North Korean workers and provided access to their networks, making it easier for cybercriminals to connect to US servers without raising suspicion.
Investigators also revealed that workers created fake websites to support their employment profiles. Some of these sites contained clearly dubious information or meaningless phrases, which should have alerted the contracting companies. However, the lack of stricter controls allowed the scheme to operate for several years, generating large economic losses and security risks.
After extensive research, the United States Department of Justice (DOJ) filed charges against 14 North Korean citizens in the Missouri Federal Court. The men face multiple charges, including conspiracy to violate the International Emergency Economic Powers Act, wire fraud, money laundering and identity theft. Additionally, eight of the defendants face charges of aggravated identity theft.
According to authorities, the defendants face sentences that could reach up to 27 years in prison if they are found guilty. However, most of them are found in North Koreamaking it difficult to capture and process.
As part of efforts to discontinue this operation, in October 2023 the FBI seized $1.5 million and 17 internet domains linked to the scheme. This action represents the first concrete results of the investigation, although authorities warn that it only represents a fraction of the scheme’s full scope.
US authorities have taken a firm stance to combat this scheme and mitigate future risks. He FBIin collaboration with the DOJ and the State Departmentlaunched a joint operation to identify those responsible and prevent the infiltration of North Korean workers into more American companies.
One of the main strategies is the offer of a reward of up to $5 million for information leading to the arrest of the suspects or other people associated with the front companies, Yanbian Silverstar y Volasys Silverstaroperational in China and Russia, respectively. These companies have previously been sanctioned by the United States Department of the Treasury.
Additionally, the FBI has issued warnings to American companies, urging them to implement rigorous vetting processes for remote workers. The recommendations include requiring interviews by video call and regularly monitoring the activity of employees, particularly those hired in the information technology sector. These measures seek to limit access by malicious actors and protect sensitive data systems.
