Identities of More Than 80 Americans Stolen for North Korean IT Worker Scams

For years, the North Korean government has found a burgeoning source of sanctions-evading revenue by tasking its citizens with secretly applying for remote tech jobs in the West. A newly revealed takedown operation by American law enforcement makes clear just how much of the infrastructure used to pull off those schemes has been based in the United States—and just how many Americans' identities were stolen by the North Korean impersonators to carry them out.

On Monday, the Department of Justice announced a sweeping operation to crack down on US-based elements of the North Korean remote IT workers scheme, including indictments against two Americans who the government says were involved in the operations—one of whom the FBI has arrested. Authorities also searched 29 “laptop farms” across 16 states allegedly used to receive and host the PCs the North Korean workers remotely access, and seized around 200 of those computers as well as 21 web domains and 29 financial accounts that had received the revenue the operation generated. The DOJ’s announcement and indictments also reveal how the North Koreans didn’t merely create fake IDs to insinuate themselves into Western tech firms, according to authorities, but allegedly stole the identities of “more than 80 US persons” to impersonate them in jobs at more than a hundred US companies and funnel money to the Kim regime.

“It's huge,” says Michael Barnhart, an investigator focused on North Korean hacking and espionage at DTEX, a security firm focused on insider threats. “Whenever you have a laptop farm like this, that's the soft underbelly of these operations. Shutting them down across so many states, that's massive.”

In total, the DOJ says it's identified six Americans it believes were involved in a scheme to enable the North Korean tech worker impersonators, though only two have been named and criminally charged—Kejia Wang and Zhenxing Wang, both based in New Jersey—and only Zhenxing Wang has been arrested. Prosecutors accuse the two men of helping to steal the identities of scores of Americans for the North Koreans to assume, receiving laptops sent to them by their employers, setting up remote access for North Koreans to control those machines from across the world—often enabling that remote access using a hardware device called a “keyboard-video-mouse switch” or KVM—and creating shell companies and bank accounts that allowed the North Korean government to receive the salaries they allegedly earned. The DOJ says the two American men also worked with six named Chinese coconspirators, according to the charging documents, as well as two Taiwanese nationals.

To create the cover identities for the North Korean workers, prosecutors say the two Wangs accessed the personal details of more than 700 Americans in searches of private records. But for the individuals the North Koreans impersonated, they allegedly went far further, using scans of the identity theft victims' drivers' licenses and Social Security cards to enable the North Koreans to apply for jobs under their names, according to the DOJ.

It's not clear from the charging documents just how those personal documents were allegedly obtained. But DTEX's Barnhart says North Korean impersonation operations typically obtain Americans' identifying documents from dark web cybercriminal forums or data leak sites. In fact, he says the 80-plus stolen identities cited by the DOJ represent a tiny sample of thousands of US IDs he's seen pulled in some cases from North Korean hacking operations' infrastructure.

“They have a stable of these,” says Barnhart. “Any place a criminal is going to get an ID, they're just going to piggyback, because then they don't even have to carry out the breach. It's already out there.” Barnhart says he's seen North Korean impersonators go so far as to screen their stolen identities for criminal backgrounds and even choose to impersonate Americans who are based in states without income tax to maximize their earnings.

Distinct from the DOJ's charges against Kejia Wang and Zhenxing Wang, prosecutors also announced that the FBI had carried out searches of 21 other suspected laptop farms across 14 US states and seized approximately 137 PCs that prosecutors say were used in North Korean remote worker schemes. In two other cases, prosecutors say that North Koreans used the insider access they gained through impersonating Western tech workers at crypto firms to steal more than $900,000 worth of funds, including around $740,000 stolen from one Atlanta-based company.

While most of the North Korean impersonation schemes the DOJ sought to disrupt appeared to be focused on money, prosecutors also note that one of the companies the North Korean workers penetrated in the operation allegedly facilitated by the two Wangs was a California-based defense contractor focused on AI-related technology. In that instance, the government claims the North Korean impersonators also accessed and likely stole technical data, including some information sensitive enough to be protected under the export controls known as the International Trafficking in Arms Regulations, or ITAR.

While the raids, indictments, and arrests carried out by the DOJ and FBI are significant, DTEX's Barnhart says, they're far from the end of North Korea's attempts to infiltrate Western and, specifically, US companies, both for profit and for espionage. Only one suspect, after all, is in custody even among the individuals the DOJ has named—and countless more North Koreans involved in these types of schemes remain untouched within the regime's borders and in the neighboring regions of China where they operate.

“This is going to put a heavy dent in what they're doing,” says Barnhart. “But as we adapt, they adapt.”