DOJ indicts five in North Korean fake IT worker scheme | CyberScoop<\/title> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/doj-indicts-five-in-north-korean-fake-it-worker-scheme\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"DOJ indicts five in North Korean fake IT worker scheme\"> <meta property=\"og:description\" content=\"The department alleges that a North Carolina-based laptop farm enabled access for two North Korean nationals over the course of the scheme.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/doj-indicts-five-in-north-korean-fake-it-worker-scheme\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2025-01-23T20:59:08+00:00\"> <meta property=\"article:modified_time\" content=\"2025-01-23T20:59:10+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/doj-indicts-five-in-north-korean-fake-it-worker-scheme-2.jpg\"> <meta property=\"og:image:width\" content=\"2121\"> <meta property=\"og:image:height\" content=\"1414\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"mbracken\"> <meta name=\"twitter:card\" content=\"summary_large_image\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1732206022g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1736472017g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1737070850g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=cc5cb8dd0a9ba2b865c4\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/83271\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.7.1\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=83271\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fdoj-indicts-five-in-north-korean-fake-it-worker-scheme%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fdoj-indicts-five-in-north-korean-fake-it-worker-scheme%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-83271 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/doj-indicts-five-in-north-korean-fake-it-worker-scheme\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--event js-stickybar\">\n<div class=\"stickybar__details\" readability=\"5.12\">\n<div class=\"stickybar__info js-sticky-bar-content\" readability=\"32\">\n<p>Nominations can be submitted for the 2025 CyberScoop 50 awards!<\/p>\n<\/div>\n<p> <a class=\"stickybar__link button button-tertiary\" href=\"https:\/\/cyberscoop.com\/cyberscoop50\/\">Click here!<\/a> <\/div>\n<p> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.067567567568\">\n<div class=\"single-article__header-content\" readability=\"33.979591836735\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/doj-indicts-five-in-north-korean-fake-it-worker-scheme\/\"> <span>Cybercrime<\/span> <\/a> <\/li>\n<\/ul>\n<p> The department alleges that a North Carolina-based laptop farm enabled access for two North Korean nationals over the course of the scheme. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/83271\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"426\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/doj-indicts-five-in-north-korean-fake-it-worker-scheme.jpg?resize=640%2C426&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/doj-indicts-five-in-north-korean-fake-it-worker-scheme-2.jpg 2121w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/doj-indicts-five-in-north-korean-fake-it-worker-scheme-2.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/doj-indicts-five-in-north-korean-fake-it-worker-scheme-2.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/doj-indicts-five-in-north-korean-fake-it-worker-scheme-2.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/doj-indicts-five-in-north-korean-fake-it-worker-scheme-2.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/doj-indicts-five-in-north-korean-fake-it-worker-scheme-2.jpg?resize=2048,1365 2048w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/doj-indicts-five-in-north-korean-fake-it-worker-scheme-2.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/doj-indicts-five-in-north-korean-fake-it-worker-scheme-2.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/doj-indicts-five-in-north-korean-fake-it-worker-scheme-2.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/doj-indicts-five-in-north-korean-fake-it-worker-scheme-2.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/doj-indicts-five-in-north-korean-fake-it-worker-scheme-2.jpg?resize=1265,843 1265w\" sizes=\"(max-width: 1013px) 100vw, 1013px\"><figcaption> (Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"40.815275310835\"><body readability=\"82.105156723964\"><\/p>\n<p>The U.S. government delivered another blow to North Korea\u2019s fake IT worker scheme Thursday, with the Department of Justice <a href=\"https:\/\/www.justice.gov\/opa\/pr\/two-north-korean-nationals-and-three-facilitators-indicted-multi-year-fraudulent-remote\">announcing indictments against five men<\/a> for fraudulently obtaining remote credentials to work with American companies and generate revenue for Pyongyang.<\/p>\n<p>The indictments of North Korean nationals Jin Sung-Il and Pak Jin-Song, Mexican national Pedro Ernesto Alonso De Los Reyes, and U.S. nationals Erick Ntekereze Prince and Emanuel Ashtor follow <a href=\"https:\/\/www.justice.gov\/opa\/pr\/justice-department-announces-court-authorized-action-disrupt-illicit-revenue-generation\">previous<\/a> <a href=\"https:\/\/www.justice.gov\/opa\/pr\/justice-department-announces-arrest-premises-search-and-seizures-multiple-website-domains\">DOJ<\/a> <a href=\"https:\/\/www.justice.gov\/opa\/pr\/justice-department-disrupts-north-korean-remote-it-worker-fraud-schemes-through-charges-and\">actions<\/a> <a href=\"https:\/\/www.justice.gov\/opa\/pr\/fourteen-north-korean-nationals-indicted-carrying-out-multi-year-fraudulent-information\">targeting<\/a> related schemes, and come a week after the Treasury Department <a href=\"https:\/\/cyberscoop.com\/treasury-sanctions-north-korea-over-remote-it-worker-schemes\/\">sanctioned two individuals and four entities<\/a> for allegedly engaging in similar behavior. <\/p>\n<p>\u201cThe Department of Justice remains committed to disrupting North Korea\u2019s cyber-enabled sanctions-evading schemes, which seek to trick U.S. companies into funding the North Korean regime\u2019s priorities, including its weapons programs,\u201d Devin DeBacker, supervisory official with the Justice Department\u2019s National Security Division, said in a statement. <\/p>\n<p>\u201cOur commitment includes the vigorous pursuit of both the North Korean actors and those providing them with material support,\u201d he continued. \u201cIt also includes standing side-by-side with U.S. companies to not only disrupt ongoing victimization, but also to help them independently detect and prevent such schemes in the future.\u201d<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>The new <a href=\"https:\/\/www.justice.gov\/opa\/media\/1386281\/dl?utm_medium=email&utm_source=govdelivery\">indictment<\/a> alleges that the defendants collected at least $866,255 in revenue from 10 U.S. companies, while gaining employment from at least 64 American firms over the course of the scheme, which ran from approximately April 2018 through August 2024. Most of the payments were laundered through a Chinese bank account, the DOJ said.<\/p>\n<p>Forged and stolen identity documents, including U.S. passports with stolen personally identifiable information of an American individual, were used to obscure the actual identities of Jin, Pak and other co-conspirators from North Korea, according to the indictment. <\/p>\n<p>By concealing their true identities, the defendants were able to get jobs with U.S. companies, while Ntekereze and Ashtor allegedly hosted laptops from the companies at their residences and downloaded and installed remote access software on them, enabling access for the fake IT workers.<\/p>\n<p>\u201cFBI investigation has uncovered a years-long plot to install North Korean IT workers as remote employees to generate revenue for the DPRK regime and evade sanctions,\u201d Bryan Vorndran, assistant director of the FBI\u2019s Cyber Division, said in a statement. \u201cThe indictments announced today should highlight to all American companies the risk posed by the North Korean government.\u201d <\/p>\n<p>The FBI arrested Ntekereze and Ashtor after a search of Ashtor\u2019s North Carolina residence, which previously served as the home base for the \u201claptop farm.\u201d Alonso, meanwhile, was arrested Jan. 10 in the Netherlands. All three defendants face charges of conspiracy to cause damage to a protected computer, conspiracy to commit wire fraud and mail fraud, conspiracy to commit money laundering, and conspiracy to transfer false identification documents.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Jin and Pak face the same charges, as well as a conspiracy to violate the International Emergency Economic Powers Act charge. All five defendants face up to 20 years in prison.<\/p>\n<p>Last week\u2019s sanctions from the Treasury Department\u2019s Office of Foreign Assets Control targeted a North Korean Ministry of National Defense-created office that <a href=\"https:\/\/cyberscoop.com\/treasury-sanctions-north-korea-over-remote-it-worker-schemes\/\">created front companies to facilitate fake IT worker schemes<\/a>, as well as two individuals and a Chinese company involved in the deception.<\/p>\n<p>Other federal government efforts against the ongoing North Korean IT operations include the <a href=\"https:\/\/cyberscoop.com\/north-korea-it-worker-fraud-tennesee-justice-department\/\">August 2024 arrest of a Tennessee man<\/a> for allegedly using stolen identities to secure remote work for North Korean nationals and the <a href=\"https:\/\/cyberscoop.com\/court-indicts-14-north-korean-it-workers-tied-to-88-million-in-illicit-gains\/\">December 2024 DOJ indictment of 14 North Koreans <\/a>who purportedly generated $88 million over the course of a six-year conspiracy.<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"4.4424131627057\">\n<div class=\"author-card\" readability=\"15\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/doj-indicts-five-in-north-korean-fake-it-worker-scheme-1.jpg?w=640&ssl=1\" alt=\"Matt Bracken\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by Matt Bracken<\/h4>\n<p> Matt Bracken is the managing editor of FedScoop and CyberScoop, overseeing coverage of federal government technology policy and cybersecurity. Before joining Scoop News Group in 2023, Matt was a senior editor at Morning Consult, leading data-driven coverage of tech, finance, health and energy. He previously worked in various editorial roles at The Baltimore Sun and the Arizona Daily Star. You can reach him at matt.bracken@scoopnewsgroup.com. <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Geopolitics<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/doj-indicts-five-in-north-korean-fake-it-worker-scheme\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>DOJ indicts five in North Korean fake IT worker scheme<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[282,338,647,2911],"tags":[286,341,240,2913],"class_list":["post-7046","post","type-post","status-publish","format-standard","hentry","category-cybercrime","category-department-of-justice-doj","category-north-korea","category-north-korean-it-workers","tag-cybercrime","tag-department-of-justice-doj","tag-north-korea","tag-north-korean-it-workers"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybercrime\/\" rel=\"category tag\">cybercrime<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/department-of-justice-doj\/\" rel=\"category tag\">Department of Justice (DOJ)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/north-korea\/\" rel=\"category tag\">North Korea<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/north-korean-it-workers\/\" rel=\"category tag\">North Korean IT workers<\/a>","tag_info":"North Korean IT workers","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7046","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=7046"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7046\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=7046"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=7046"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=7046"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":7046,"date":"2025-01-23T14:59:08","date_gmt":"2025-01-23T20:59:08","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=83271"},"modified":"2025-01-23T14:59:08","modified_gmt":"2025-01-23T20:59:08","slug":"doj-indicts-five-in-north-korean-fake-it-worker-scheme","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/01\/23\/doj-indicts-five-in-north-korean-fake-it-worker-scheme\/","title":{"rendered":"DOJ indicts five in North Korean fake IT worker scheme"},"content":{"rendered":"