Identities of More Than 80 Americans Stolen for North Korean IT Worker Scams

For years, the North Korean authorities has recovered a burgeoning root of sanctions-evading gross by tasking its citizens with secretly applying for distant tech jobs successful the West. A recently revealed takedown cognition by American instrumentality enforcement makes wide conscionable however overmuch of the infrastructure utilized to propulsion disconnected those schemes has been based successful the United States—and conscionable however galore Americans' identities were stolen by the North Korean impersonators to transportation them out.

On Monday, the Department of Justice announced a sweeping cognition to ace down connected US-based elements of the North Korean distant IT workers scheme, including indictments against 2 Americans who the authorities says were progressive successful the operations—one of whom the FBI has arrested. Authorities besides searched 29 “laptop farms” crossed 16 states allegedly utilized to person and big the PCs the North Korean workers remotely access, and seized astir 200 of those computers arsenic good arsenic 21 web domains and 29 fiscal accounts that had received the gross the cognition generated. The DOJ’s announcement and indictments besides uncover however the North Koreans didn’t simply make fake IDs to insinuate themselves into Western tech firms, according to authorities, but allegedly stole the identities of “more than 80 US persons” to impersonate them successful jobs astatine much than a 100 US companies and funnel wealth to the Kim regime.

“It's huge,” says Michael Barnhart, an researcher focused connected North Korean hacking and espionage astatine DTEX, a information steadfast focused connected insider threats. “Whenever you person a laptop workplace similar this, that's the brushed underbelly of these operations. Shutting them down crossed truthful galore states, that's massive.”

In total, the DOJ says it's identified six Americans it believes were progressive successful a strategy to alteration the North Korean tech idiosyncratic impersonators, though lone 2 person been named and criminally charged—Kejia Wang and Zhenxing Wang, some based successful New Jersey—and lone Zhenxing Wang has been arrested. Prosecutors impeach the 2 men of helping to bargain the identities of scores of Americans for the North Koreans to assume, receiving laptops sent to them by their employers, mounting up distant entree for North Koreans to power those machines from crossed the world—often enabling that distant entree utilizing a hardware instrumentality called a “keyboard-video-mouse switch” oregon KVM—and creating ammunition companies and slope accounts that allowed the North Korean authorities to person the salaries they allegedly earned. The DOJ says the 2 American men besides worked with six named Chinese coconspirators, according to the charging documents, arsenic good arsenic 2 Taiwanese nationals.

To make the screen identities for the North Korean workers, prosecutors accidental the 2 Wangs accessed the idiosyncratic details of much than 700 Americans successful searches of backstage records. But for the individuals the North Koreans impersonated, they allegedly went acold further, utilizing scans of the individuality theft victims' drivers' licenses and Social Security cards to alteration the North Koreans to use for jobs nether their names, according to the DOJ.

It's not wide from the charging documents conscionable however those idiosyncratic documents were allegedly obtained. But DTEX's Barnhart says North Korean impersonation operations typically get Americans' identifying documents from acheronian web cybercriminal forums oregon information leak sites. In fact, helium says the 80-plus stolen identities cited by the DOJ correspond a tiny illustration of thousands of US IDs he's seen pulled successful immoderate cases from North Korean hacking operations' infrastructure.