US authorities have charged five people for their alleged involvement in a years-long North Korean IT worker scheme that saw them get remote work with dozens of American companies. The Department of Justice on Friday announced the indictment of North Korean citizens Jin Sung-Il and Mr. Jin-Song; Pedro Ernesto Alonso De Los Reyes from Mexico, and US citizens Erick Ntekerez Prince and Emanuel Ashtor. The DOJ said the FBI arrested Ntekerez and Ashtor, and a search of Ashtor’s home in North Carolina found evidence of a “laptop farm” that hosted laptops the company had provided to trick the organization into thinking it had hired employees in the U.S. Alonso was also arrested. in the Netherlands after a US warrant was issued. According to the indictment, Ntekerese and Ashtor allegedly installed remote access software, including Anydesk and TeamViewer, on company-supplied devices, allowing the North Koreans to hide their locations. The two Americans also gave Jin and Pak false identity documents, including US passports and US bank accounts. The indictment alleges that the defendants obtained work from at least 64 American organizations during the multi-year scheme, which ran from April 2018 to August 2024. These included a US financial institution, a San Francisco-based technology company, and an IT organization headquartered in Palo Alto . According to the Justice Department, the payments from the ten companies totaled at least $866,255, most of which was laundered through Chinese bank accounts. “The Department of Justice remains committed to disrupting North Korea’s cyber-enabled sanctions scheme, which seeks to leverage US companies to finance the North Korean regime’s priorities, including its weapons program,” said Devin DeBacker, an oversight official with the Department of Justice’s National Security Agency. Division, said in a statement. Along with Thursday’s indictment, which came just days after the Treasury Department sanctioned two individuals and four entities for allegedly engaging in similar conduct, the FBI issued an advisory warning that North Korean IT workers are increasingly engaged in nefarious activities, including data extortion. The agency said it had monitored North Korean IT workers using unauthorized access to company networks to “delete proprietary and sensitive data, facilitate cybercriminal activities, and conduct revenue-generating activities on behalf of the regime.”
