The US Justice Department on Thursday announced indictments against 14 North Korean nationals for their involvement in a multi-year scheme to pose as remote IT workers to violate sanctions and commit wire fraud, money laundering, and identity theft. 

The indictment, unsealed in federal court in St. Louis, details an elaborate operation where North Korean operatives used stolen identities and AI-generated credentials to infiltrate the US-based companies and earn cash for the North Korean regime.

Operating under North Korean-controlled companies Yanbian Silverstar in China and Volasys Silverstar in Russia, the Justice Department said, the scheme netted at least $88 million over six years, transferred through U.S. and Chinese financial systems to the North Korean government.

Beyond collecting salaries from US companies, the fake North Korean IT workers allegedly extorted their employers by stealing sensitive data, including proprietary source code, and threatening to release it unless payments were made.

According to the indictment, North Korean IT workers were mandated to earn a minimum of $10,000 monthly. The workers utilized advanced tactics to mask their origins, including deepfake identities, proxy servers, and pseudonymous online accounts. 

The Justice Department said US employers unwittingly provided the North Korean state-sponsored actors with access to sensitive systems, heightening the risk of malicious cyberattacks.

According to the indictment, the North Korean companies orchestrated “socialism competitions,” rewarding employees who generated the highest revenue.

“To prop up its brutal regime, the North Korean government directs IT workers to gain employment through fraud, steal sensitive information from U.S. companies, and siphon money back to the DPRK,” Deputy Attorney General Lisa Monaco said in a note announcing the indictments.

“While we have disrupted this group and identified its leadership, this is just the tip of the iceberg. The government of North Korea has trained and deployed thousands of IT workers to perpetrate this same scheme against U.S. companies every day,” said Special Agent in Charge Ashley Johnson of the FBI St. Louis Field Office. 

The FBI agent stressed the urgency for businesses to thoroughly vet fully remote IT workers and make it mandatory for current and future IT workers to appear on camera as often as possible if they are fully remote.

Thursday’s announcement follows multiple high-profile discoveries of North Korean infiltration into US companies. Earlier this year, cybersecurity firm KnowBe4 belatedly discovered a North Korean agent posing as a software engineer had bypassed all its hiring procedures to land a job.

The company said the North Korean IT worker used a company-issued MacBook to deploy malware within minutes of receiving the machine. KnowBe4 CEO Stu Sjouwerman noted the attacker exploited vulnerabilities in hiring and background checks, leveraging a sophisticated cover identity supported by a Raspberry Pi device and falsified documents.

Separately, the State Department announced a reward offer of up to $5 million for information on the companies and individuals linked to the scheme: Jong Song Hwa (정성화), Ri Kyong Sik (리경식), Kim Ryu Song (김류성), Rim Un Chol (림은철), Kim Mu Rim (김무림), Cho Chung Pom (조충범), Hyon Chol Song (현철성), Son Un Chol (손은철), Sok Kwang Hyok (석광혁), Choe Jong Yong (최정용), Ko Chung Sok (고충석), Kim Ye Won (김예원), Jong Kyong Chol (정경철), and Jang Chol Myong (장철명). 

The North Koreans are charged with conspiracy to violate the International Emergency Economic Powers Act, conspiracy to commit wire fraud, conspiracy to commit money laundering, and conspiracy to commit identity theft.  

Related:  KnowBe4 Catches Fake North Korean IT Worker Planting Malware 

Related: North Korean IT Workers Infiltrating Hundreds of US Firms

Related: North Korean APT Caught Hacking Security Researchers

Related: Mandiant Catches Another North Korean Gov Hacker Group

Related: North Korean Gov Hackers Caught Rigging Legit Software