DOJ Sentences 2 Men in DPRK Remote IT Worker Scheme

The Department of Justice (DOJ) has sentenced two men to 18 months in prison each after they helped North Korean IT workers obtain U.S.-based jobs by hosting company laptops and enabling remote overseas access. 

Matthew Issac Knoot and Erick Ntekereze Prince targeted nearly 70 companies and generated more than $1.2 million in revenue for the Democratic People’s Republic of Korea (DPRK) through the IT fraud scheme, DOJ said. 

According to the department, Knoot and Prince received and hosted laptops at their residences that U.S. companies shipped to IT workers they believed were based at the men’s homes. After receiving the laptops, the defendants installed remote access software that enabled overseas co-conspirators to work remotely while appearing to employers as though they were operating from the United States. 

The DOJ said the overseas IT workers used false and stolen identities to secure employment with U.S. companies. 

“This scheme shows how national security threats now enter through ordinary business systems,” said U.S. Attorney Jason Reding Quiñones for the Southern District of Florida in a statement. “These were not paperwork violations. They were deliberate acts that exposed U.S. businesses, compromised trust, and supported one of the world’s most dangerous adversaries.” 

The sentencing marks the latest action under the DOJ’s Domestic Enabler Initiative, which aims to disrupt DPRK revenue-generation operations and target U.S.-based facilitators of those schemes. 

Federal officials have warned for several years about North Korean remote IT worker operations. DOJ said DPRK-linked workers have posed as legitimate remote IT employees to generate revenue for the regime and, in some cases, commit data extortion. 

According to the department, those operations often rely on stolen identities, alias email accounts, fake social media profiles, online payment platforms, fraudulent job site accounts, proxy computers, and third parties located in the United States and other countries. 

“The FBI and our partners will continue to disrupt North Korea’s ability to circumvent sanctions and fund its totalitarian regime,” said Brett Leatherman, assistant director of the FBI’s Cyber Division. “Hosting laptops for DPRK IT workers is a federal crime which directly impacts our national security, and these sentences should serve as a warning to anyone considering it.”