Arizona woman arrested and charged in North Korean IT worker scheme | CyberScoop<\/title> <meta name=\"description\" content=\"Christina Chapman facilitated remote work and financial transfers for North Koreans tied to that nation\u2019s weapons development programs, according to the U.S. government.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/arizona-woman-arrested-and-charged-in-north-korean-it-worker-scheme\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Arizona woman arrested and charged in North Korean IT worker scheme\"> <meta property=\"og:description\" content=\"Christina Chapman facilitated remote work and financial transfers for North Koreans tied to that nation\u2019s weapons development programs, according to the U.S. government.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/arizona-woman-arrested-and-charged-in-north-korean-it-worker-scheme\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2024-05-16T19:23:32+00:00\"> <meta property=\"article:modified_time\" content=\"2024-05-16T19:23:33+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/arizona-woman-arrested-and-charged-in-north-korean-it-worker-scheme-2.jpg\"> <meta property=\"og:image:width\" content=\"1920\"> <meta property=\"og:image:height\" content=\"1280\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"AJ Vicens\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@AJVicens\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1715117951g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1715187471g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1715025738g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=74528d75ce0daeb8628a\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/80460\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.5.3\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=80460\">\n<link rel=\"alternate\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Farizona-woman-arrested-and-charged-in-north-korean-it-worker-scheme%2F\">\n<link rel=\"alternate\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Farizona-woman-arrested-and-charged-in-north-korean-it-worker-scheme%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-80460 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/arizona-woman-arrested-and-charged-in-north-korean-it-worker-scheme\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.8\">\n<div class=\"single-article__header-content\" readability=\"31.545126353791\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/news\/geopolitics\/\"> <span>Geopolitics<\/span> <\/a> <\/li>\n<\/ul>\n<p> Christina Chapman facilitated remote work and financial transfers for North Koreans tied to that nation\u2019s weapons development programs, according to the U.S. government. <\/p>\n<\/p><\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"426\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/arizona-woman-arrested-and-charged-in-north-korean-it-worker-scheme.jpg?resize=640%2C426&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/arizona-woman-arrested-and-charged-in-north-korean-it-worker-scheme-2.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/arizona-woman-arrested-and-charged-in-north-korean-it-worker-scheme-2.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/arizona-woman-arrested-and-charged-in-north-korean-it-worker-scheme-2.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/arizona-woman-arrested-and-charged-in-north-korean-it-worker-scheme-2.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/arizona-woman-arrested-and-charged-in-north-korean-it-worker-scheme-2.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/arizona-woman-arrested-and-charged-in-north-korean-it-worker-scheme-2.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/arizona-woman-arrested-and-charged-in-north-korean-it-worker-scheme-2.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/arizona-woman-arrested-and-charged-in-north-korean-it-worker-scheme-2.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/arizona-woman-arrested-and-charged-in-north-korean-it-worker-scheme-2.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/arizona-woman-arrested-and-charged-in-north-korean-it-worker-scheme-2.jpg?resize=1265,843 1265w\" sizes=\"(max-width: 1013px) 100vw, 1013px\"><figcaption> In a photo taken on April 18, 2019, people stand before computer screens in a lobby of the Grand People’s Study House in Pyongyang. (Photo by ED JONES\/AFP via Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"41.886625456589\"><body readability=\"84.805405405405\"><\/p>\n<p>An Arizona woman participated in a scheme to help North Korean information technology workers pose as U.S. citizens so they could apply for remote work positions at Americans companies, federal prosecutors said Thursday as they unsealed charges against the woman and several others. <\/p>\n<p>Prosecutors say that as part of the scheme, Christina Marie Chapman, 49, of Litchfield Park, Ariz., helped a Ukrainian national and three North Koreans compromise scores of Americans\u2019 identities to facilitate remote work positions for IT workers, most of whom were tied to North Korea. The operation netted at least $6.8 million in revenue generated for the overseas workers, the <a href=\"https:\/\/www.justice.gov\/usao-dc\/pr\/us-citizen-and-four-foreign-nationals-charged-cyber-schemes-designed-benefit-north-korea\">U.S. Department of Justice said in a statement<\/a>.<\/p>\n<p>Chapman allegedly worked with Oleksandr Didenko, 27, of Kyiv, Ukraine, as part of the scheme. Didenko allegedly carried out a multi-year scheme to create accounts at U.S.-based freelance IT job search platforms and with U.S. money service transmitters in the name of false identities, the DOJ said in its statement. Those accounts were then sold to the overseas IT workers, who used the identities to apply for remote work positions.<\/p>\n<p>Chapman was arrested May 15 in Arizona and faces up to 97.5 years in prison, according to the DOJ. Didenko faces up to 67.5 years for his role.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>The U.S. government through the State Department\u2019s Rewards for Justice program <a href=\"https:\/\/rewardsforjustice.net\/rewards\/north-korean-information-technology-it-workers\/\">announced a reward of up to $5 million<\/a> for information related to the effort and specifically three North Koreans with the aliases of Jiho Han, Chunji Jin and Haoran Xu, as well as their manager, Zhonghua. <\/p>\n<p>The North Koreans, if ever brought to the U.S., face a maximum penalty of 20 years in prison.<\/p>\n<p>\u201cThese IT workers are linked to the DPRK\u2019s Munitions Industry Department, which oversees the development of the DPRK\u2019s ballistic missiles, weapons production, and research and development programs,\u201d the State Department said in the reward announcement.<\/p>\n<p>Chapman\u2019s alleged role was to operate a \u201claptop farm,\u201d where she hosted the overseas IT workers\u2019 computers inside her home to make it appear as if the computers were located within the United States. She also allegedly received checks and direct deposits for the IT workers into her U.S. financial accounts. <\/p>\n<p>The workers managed to gain employment at various unnamed U.S. companies, according to the DOJ, \u201cincluding a top-five major television network, a Silicon Valley technology company, an aerospace and defense company, an American car manufacturer, a luxury retail store, and a U.S.-hallmark media and entertainment company, all of which were Fortune 500 companies.\u201d<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>North Korean IT workers with access to U.S. companies represent a dangerous insider threat, said Michael Barnhart, principal analyst with Mandiant focused on North Korean threats. <\/p>\n<p>\u201cBy directing its IT workers to gain employment at Western companies, North Korea has weaponized its tech talent and created the ultimate insider threat,\u201d Barnhart said in a statement. \u201cThese operatives bypass sanctions by diverting their paychecks to help fund North Korea\u2019s nuclear program.\u201d<\/p>\n<p>The workers are also \u201cproviding a foothold into major organizations for North Korea\u2019s more advanced threat group,\u201d he added, which can be leveraged for additional operations and attacks.<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"1.1842105263158\">\n<div class=\"author-card\" readability=\"8\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/05\/arizona-woman-arrested-and-charged-in-north-korean-it-worker-scheme-1.jpg?w=640&ssl=1\" alt=\"AJ Vicens\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by AJ Vicens<\/h4>\n<p> AJ covers nation-state threats and cybercrime. He was previously a reporter at Mother Jones. Get in touch via Signal\/WhatsApp: (810-206-9411). <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Geopolitics<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/arizona-woman-arrested-and-charged-in-north-korean-it-worker-scheme\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Arizona woman arrested and charged in North Korean IT worker<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[338,302,2064,647,288],"tags":[341,306,2065,240,294],"class_list":["post-3612","post","type-post","status-publish","format-standard","hentry","category-department-of-justice-doj","category-geopolitics","category-it-workers","category-north-korea","category-threats","tag-department-of-justice-doj","tag-geopolitics","tag-it-workers","tag-north-korea","tag-threats"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/department-of-justice-doj\/\" rel=\"category tag\">Department of Justice (DOJ)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/geopolitics\/\" rel=\"category tag\">Geopolitics<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/it-workers\/\" rel=\"category tag\">IT workers<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/north-korea\/\" rel=\"category tag\">North Korea<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/threats\/\" rel=\"category tag\">Threats<\/a>","tag_info":"Threats","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/3612","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=3612"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/3612\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=3612"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=3612"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=3612"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":3612,"date":"2024-05-16T14:23:32","date_gmt":"2024-05-16T19:23:32","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=80460"},"modified":"2024-05-16T14:23:32","modified_gmt":"2024-05-16T19:23:32","slug":"arizona-woman-arrested-and-charged-in-north-korean-it-worker-scheme","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/05\/16\/arizona-woman-arrested-and-charged-in-north-korean-it-worker-scheme\/","title":{"rendered":"Arizona woman arrested and charged in North Korean IT worker scheme"},"content":{"rendered":"