DOJ Announces Indictments in Takedown of North Korean Remote Worker Operation
Udumbara
The defendants were accused of running the scheme to help remote North Korean IT workers obtain jobs at more than 100 U.S. companies, including many Fortune 500 companies, by compromising more than 80 Americans’ identities. These companies incurred a loss of at least $3 million in legal fees, computer network remediation costs, and other damages as a result of the scheme.
“While some of these IT workers operate from cities inside North Korea, many work in the People’s Republic of China (‘China’) in cities near the North Korean border, including in Dandong and Shenyang,” the indictment reads. Dandong and Shenyang are cities in northern China’s Liaoning Province, which borders North Korea.
One of the defendants, U.S. national Zhenxing “Danny” Wang, was arrested in New Jersey on June 30. Wang is accused of conspiracy to commit wire and mail fraud, money laundering, and identify theft.
The six Chinese nationals are listed in the U.S. Attorney’s Office statement as Jing Bin Huang, Baoyu Zhou, Tong Yuze, Yongzhe Xu, Ziyou Yuan, and Zhenbang Zhou. The remaining two defendants are Taiwanese nationals, named Mengting Liu and Enchia Liu.
Wang and another individual, Kejia Wang, along with at least four other unnamed U.S. “facilitators,” allegedly assisted the North Koreans by operating company-issued laptops giving them unauthorized remote access, creating financial accounts to receive money earned from their employment, and establishing U.S.-based shell companies to make the workers appear more authentic, according to prosecutors. In return, the group received at least $696,000 in fees.
According to the indictment, Huang, a Dandong resident, allegedly “registered accounts with money transfer services ... and foreign banks that were used to receive and transfer proceeds generated through the conspiracy.”
The indictment listed several unnamed individuals who allegedly helped host the victim companies’ laptops.
“Individual C was a California resident, an active-duty member of the United States military, and a Secret clearance holder who, in exchange for a fee, hosted U.S. victim company laptops at Individual C’s residence and facilitated remote access to the laptops by overseas IT workers,” the indictment reads.
“North Korean IT workers defraud American companies and steal the identities of private citizens, all in support of the North Korean regime,” Assistant Director Brett Leatherman of the FBI’s Cyber Division said in a statement. “Let the actions announced today serve as a warning: if you host laptop farms for the benefit of North Korean actors, law enforcement will be waiting for you.”
The scheme allegedly also involved the North Korean employees stealing sensitive data, such as source code, from their employers. According to the indictment, one of the victims was a California-based defense contractor, whose documents and computer files containing sensitive U.S. military technology, regulated under the International Traffic in Arms Regulations, were stolen.
The four defendants were accused of stealing more than $900,000 in virtual currency from two companies under a similar remote IT work scheme.
.
