DOJ charges 4 North Koreans for posing as IT workers to steal US money

The Justice Department on Monday charged four North Koreans in a brazen scam to pose as IT workers with stolen credentials and use them to get hired by U.S.-based companies and scam those companies out of hundreds of thousands of dollars.

Kim Kwang Jin, Kang Tae Bok, Jong Pong Ju and Chang Nam Il are all allegedly "citizens of North Korea who used stolen and false personally identifiable information to pose as non-North Koreans and thereby obtain employment with technology companies, gain victim companies' trust, obtain access to virtual currency assets controlled by victim companies, steal those virtual currency assets, and launder the proceeds of that activity."

Federal authorities in Atlanta, Georgia said that the four allegedly stole $900,000 in cryptocurrency from one company, according to prosecutors, and the scheme has been ongoing since at least 2020.

In one instance, a U.S. company hired who they thought was Malaysian IT worker "Bryan Cho," but in reality they hired Jong Pong Ju, who was a North Korean bad actor, according to the Justice Department.

Hiring "Byran Cho" also allowed for other North Koreans to be brought into the fold, including Chang Nam Il, the department said.

"On or about March 29, 2022, defendant KIM KW ANG JIN, without Company-1's knowledge or consent, modified the source code for two smart contracts owned and controlled by Company-1 that resided on the Ethereum and Polygon blockchains. Defendant KIM KW ANG JIN' s modifications to these smart contracts changed the rules governing the withdrawal of virtual currency from two funding pools controlled by Company-1," the court record says.

The four are not in the U.S., the department noted.

In total, the Justice Department seized 29 known or suspected "laptop farms" across 16 states, and seized 29 financial accounts used to launder illicit funds and 21 fraudulent websites, and charged four North Korean nationals, six Chinese nationals and two Taiwanese nationals for their involvement in separate information technology worker schemes, DOJ officials told reporters on a call with reporters on Monday.

In Massachusetts, the Justice Department alleges that nine more North Koreans posed as IT workers and were able to cause $3 million in losses from more than 100 U.S. companies, including some Fortune 500 companies over a four-year period, as well as steal "export controls and US military technology off the company's network," the official said.

Kejia Wang, a U.S. citizen, worked with others abroad to "to facilitate the criminal schemes" alleged by the Justice Department. According to senior DOJ officials, Wang was arrested on Monday.

Similar to the case unsealed earlier today in Georgia, workers posing as tech workers used fraudulent identification cards to dupe U.S. companies., according to the department.

Authorities said that it is not only profitable for the North Koreans, but they attempt to steal U.S. secrets as well.

"These schemes target and steal from U.S. companies and are designed to evade sanctions and fund the North Korean regime's illicit programs, including its weapons programs," John A. Eisenberg, Assistant Attorney General for the Department's National Security Division, said in a release. "The Justice Department, along with our law enforcement, private sector, and international partners, will persistently pursue and dismantle these cyber-enabled revenue generation networks."