FBI Reveals Thousands of Remote IT Workers Sending Wages to North Korea for Weapons Program

32

In a startling revelation, the FBI and the Department of Justice have disclosed that thousands of information technology (IT) workers, contracted with U.S. companies, have been clandestinely channeling millions of dollars of their earnings to North Korea to support its ballistic missile program.

According to the Justice Department’s statement on Wednesday, these IT workers, dispatched and contracted by North Korea, have been operating under false identities to secure employment with companies in various locations across the U.S., including St. Louis. The funds they earned were then funneled directly into North Korea’s weapons development efforts, as announced during a news conference held by FBI leaders in St. Louis.

Court documents pertaining to this case indicate that North Korea’s government strategically dispatched skilled IT workers to primarily reside in China and Russia. Their mission was to deceive businesses, not only in the U.S. but also internationally, into hiring them as freelance remote employees. To appear as though they were working from within the U.S., these workers employed various tactics, such as paying American citizens to utilize their home Wi-Fi connections, as disclosed by Jay Greenberg, the special agent in charge of the St. Louis FBI office.

Greenberg emphasized that any company hiring freelance IT workers during this period “more than likely” engaged individuals involved in this scheme. An FBI spokesperson, Rebecca Wu, further revealed that the North Korean government contracted with companies not only in the U.S. but also in other countries.

“We can tell you that there are thousands of North Korean IT workers that are part of this,” stated spokeswoman Rebecca Wu.

As part of their investigation, federal authorities have already seized $1.5 million in assets and 17 domain names. This investigation is ongoing.

The prevalence of this scheme has prompted the FBI to advise companies to take additional precautions when hiring remote IT workers, including conducting video interviews to verify their identities.

The IT workers involved in this operation generated millions of dollars annually in wages to support North Korea’s weapons programs. Additionally, in certain cases, these North Korean workers infiltrated the computer networks of the companies that hired them, stealing sensitive information. They also maintained access for potential future hacking and extortion endeavors, as reported by the Justice Department.

While the authorities did not disclose the names of the companies unknowingly involved in hiring North Korean workers or provide details regarding when this practice began, it is known that federal authorities have been aware of this scheme for some time.

Back in May 2022, the State Department, Department of the Treasury, and the FBI jointly issued an advisory warning about North Koreans attempting to secure employment by posing as non-North Korean nationals. The advisory highlighted the regime’s increased focus on IT-related education and training in recent years.

John Hultquist, head of threat intelligence at cybersecurity firm Mandiant, noted that North Korea’s use of IT freelancers to finance its weapons program has been ongoing for over a decade, with the COVID-19 pandemic providing a boost to these efforts.

“Tensions on the Korean Peninsula have escalated, with North Korea conducting over 100 missile tests since the start of 2022, while the U.S. has expanded its military exercises with Asian allies in a tit-for-tat response.”

The Justice Department has been actively working to expose and disrupt various criminal schemes aimed at bolstering the North Korean regime, including its nuclear weapons program. This includes charging individuals and entities involved in evading sanctions, hacking, and other illicit activities.

In February, United Nations experts reported that North Korean hackers had stolen record-breaking virtual assets, emphasizing the regime’s interest in cyberfinance and the acquisition of information to support its nuclear and ballistic missile programs.

—-
Eric Tucker in Washington, D.C, contributed to this report.

Frequently Asked Questions (FAQs) about Keyword: North Korea IT workers

More about Keyword: North Korea IT workers

• FBI and Department of Justice Announcement
• Justice Department Statement
• Cybersecurity Firm Mandiant
• State Department Advisory
• United Nations Report on North Korean Hackers