Thousands of information technology workers under contract with U.S. companies secretly funneled millions of dollars in wages to North Korea for years for use in the country's ballistic missile program, FBI and Justice Department officials said.Information technology workers dispatched by North Korea and contracted to work remotely with companies in St. Louis and elsewhere in the United States have been using false identities to obtain jobs, the Justice Department said Wednesday. The FBI chief told a news conference in St. Louis that the money they made was funneled into North Korea's weapons programs.
Court documents allege that the North Korean government dispatched thousands of skilled IT workers, primarily based in China and Russia, with the goal of deceiving businesses in the United States and elsewhere into hiring them as remote freelance employees. Jay Greenberg, special agent in charge of the FBI's St. Louis field office, said the workers used various tactics to make it appear they were working in the United States, including paying Americans to use their home Wi-Fi networks.
Greenberg said any company hiring freelance IT workers "most likely" hired someone who participated in the program. An FBI spokeswoman said Thursday that the North Koreans had contracts with companies across the U.S. and a number of other countries.
"The information we have is that thousands of North Korean IT employees were involved in this operation," said spokesperson Rebecca Wu.
Federal authorities announced the seizure of $1.5 million and 17 domain names as part of the investigation, which is still ongoing. Bureau officials said the scam is so common that companies must be extra vigilant when verifying job candidates, including requiring that candidates pass at least a video interview.
"At the very least, the FBI recommends that employers take more proactive measures against remote IT workers to make it harder for bad actors to hide their identities," Greenberg said in a press release.
These IT employees earn millions of dollars in wages each year to fund North Korea's weapons programs. In some cases, the Justice Department said, these North Korean workers also infiltrated computer networks to steal information from the companies that employed them. They also maintained access for future hacking and extortion schemes, the Justice Department said.
Officials did not name the companies that unknowingly hired North Korean workers, nor did they say when the practice began or detail how investigators became aware of it. But federal authorities have been aware of the scheme for some time.
In May 2022, the U.S. Departments of State, Treasury and the FBI issued a bulletin warning North Koreans of attempts to "obtain employment by impersonating non-North Korean nationals." The warning noted that in recent years, Kim Jong-un's regime has "increasingly attached importance to education and training" in information technology-related disciplines.
North Korea's practice of using IT freelancers to fund weapons programs has been around for more than a decade, but the COVID-19 pandemic has given a boost to the effort, said John Hultquist, director of threat intelligence at cybersecurity firm Mandiant.
"I think the post-COVID-19 pandemic world creates more opportunities for them as freelancers and remote recruiting become a more natural part of the business than they have in the past," Hultquist said. North Korea also uses workers in other fields to funnel money into its weapons programs, but high wages for skilled workers provide a more lucrative resource.
Tensions are high on the Korean peninsula as North Korea has tested more than 100 missiles since early 2022 and the United States has expanded military exercises with its Asian allies in response.
In recent years, the Department of Justice has worked to uncover and dismantle various criminal plots designed to support the North Korean regime, including its nuclear weapons program. For example, in 2016, four Chinese citizens and a trading company were charged in the United States with using front companies to evade sanctions targeting North Korea's nuclear weapons and ballistic missile programs.
Two years ago, the U.S. Justice Department charged three North Korean computer programmers and members of the government's military intelligence agency in a series of global hacking campaigns that officials said were carried out at the behest of the regime. Law enforcement officials said at the time that the indictment highlighted the profit-driven motivations behind North Korea's hacking crimes, in contrast to other adversaries such as Russia, China and Iran, which are often more interested in espionage, intellectual property theft and even undermining democracy.
In September, North Korean leader Kim Jong Un called for a doubling of nuclear weapons production and for North Korea to play a greater role in an alliance of countries confronting the United States in a "new Cold War," North Korean state media said.
In February, United Nations experts said North Korean hackers working for the North Korean government had stolen a record-breaking amount of virtual assets last year, estimated to be worth between $630 million and $1 billion. Hackers are using increasingly sophisticated techniques to gain access to digital networks involved in cyber finance and steal information from governments, individuals and companies that could be useful to North Korea's nuclear and ballistic missile programs, the expert panel said in a report.