North Korean nationals indicted in scheme using IT workers to funnel money for weapons programs

ST. LOUIS — Fourteen North Korean nationals have been indicted in a scheme using information technology workers with untrue identities to agreement with U.S. companies — workers who then funneled their wages to North Korea for advancement of ballistic missiles and other weapons, the head of the FBI office in St. Louis said Thursday.

The scheme involving thousands of IT workers generated more than $88 million for the North Korean government, Ashley T. Johnson, special agent in fee of the St. Louis FBI office, said at a information conference. In addition to their wages, the workers stole sensitive information from companies or threatened to leak information in trade for extortion payments, Johnson said.

Victims included defrauded companies and people whose identities were stolen from across the U.S., including Missouri, Johnson said. The indictments were filed Wednesday in U.S. District Court in St. Louis. All 14 people face wire fraud, money laundering, identity theft and other charges.

Most of those accused are believed to be in North Korea. Johnson acknowledged that bringing them to fairness will be challenging. To assist, the U.S. Department of State is offering a $5 million reward for information leading to any of the suspects.

Federal authorities said the scheme worked like this:

North Korea dispatched thousands of IT workers to get hired and work remotely or as freelancers for U.S. companies. The IT workers involved in the scheme sometimes used stolen identities. In other instances, they paid Americans to use their home Wi-Fi connections, or to pose in on-camera job interviews as the IT workers. Johnson said the FBI is going after those “domestic enablers,” too.

“This is just the tip of the iceberg,” Johnson said. “If your corporation has hired fully remote IT workers, more likely than not, you have hired or at least interviewed a North Korean national working on behalf of the North Korean government,” Johnson said.

The fairness Department in recent years has sought to expose and disrupt a broad variety of criminal schemes aimed at bolstering the North Korean regime, including its nuclear weapons program.

In 2021, the fairness Department charged three North Korean computer programmers and members of the government’s military intelligence agency in a broad range of global hacks that officials declare were carried out at the behest of the regime. Law enforcement officials said at the period that the prosecution highlighted the gain-driven motive behind North Korea’s criminal hacking, a contrast from other adversarial nations like Russia, China and Iran that are generally more interested in espionage, intellectual property theft or even disrupting democracy.

In May 2022, the State Department, Department of the Treasury, and the FBI issued an advisory warning of attempts by North Koreans “to obtain employment while posing as non-North Korean nationals.” The advisory noted that in recent years, the regime of Kim Jong Un “has placed increased focus on education and training” in IT-related subjects.

In October 2023, the FBI in St. Louis announced the seizure of $1.5 million and 17 domain names as part of the investigation. The indictments announced Tuesday were the first stemming from the investigation.

Johnson urged companies to thoroughly vet IT workers hired to work remotely. “One of the ways to assist minimize your hazard is to insist current and upcoming IT workers appear on camera as often as feasible if they are fully remote,” she said.

Officials didn’t name the companies that unknowingly hired North Korean workers.