August 26th, 2024

US dismantles laptop farm used by undercover North Korean IT workers

Matthew Isaac Knoot was arrested for facilitating North Korean IT workers in remote jobs, using stolen identities and laundering payments, generating over $250,000 per worker, funding North Korea's nuclear program.

Read original articleLink Icon
US dismantles laptop farm used by undercover North Korean IT workers

The U.S. Justice Department has arrested Matthew Isaac Knoot, a Nashville resident, for facilitating North Korean IT workers in obtaining remote jobs with U.S. companies through a laptop farm. Knoot allegedly helped these workers, who were using a stolen identity to pose as a U.S. citizen named Andrew M., by providing housing for company laptops and laundering payments to North Korean and Chinese accounts. The laptops were shipped to Knoot's residences, where he installed unauthorized remote desktop applications, allowing the North Koreans to access victim companies' networks from China. This operation reportedly generated over $250,000 for each worker involved, contributing to North Korea's nuclear weapons program. Knoot faces multiple charges, including wire fraud and identity theft, with a potential maximum sentence of 20 years. This case is part of a broader initiative by U.S. authorities to dismantle such operations, as another American, Christina Marie Chapman, was also charged for running a similar laptop farm. The FBI has warned about the prevalence of North Korean IT workers impersonating U.S. staff, highlighting the ongoing threat they pose to American companies.

- Matthew Knoot was arrested for aiding North Korean IT workers in remote jobs.

- The operation involved using stolen identities and laundering payments.

- Each North Korean worker earned over $250,000, funding North Korea's nuclear program.

- Knoot faces serious charges, including wire fraud and identity theft.

- This case is part of a larger initiative to combat North Korean cyber threats.

Link Icon 12 comments
By @kevdoran - 8 months
Any thoughts on how to report requests to do things like this?

I've had several emails from strangers over the past month asking to use my identity (i.e. Upwork profile), setup a report laptop, and "collaborate".

Until now I've just ignore them or mark them spam.

By @ZoomZoomZoom - 8 months
> the North Korean IT workers who used Knoot's laptop farm generated revenue for North Korea's nuclear weapons program

Such an off-handed manner of presenting a really strong accusation! How did they do it exactly, directly, or just being citizens and paying taxes?

By @jetbalsa - 8 months
It amazes me they didn't use some kind of KVM on these laptops instead of software, most company laptops have a ton of bossware on them monitoring applications and such
By @iJohnDoe - 8 months
FTA > This happened even though KnowBe4 conducted background checks, verified references, and conducted four video interviews before hiring an individual. However, the company later discovered that the person had used a stolen identity to bypass these checks and AI tools to create a fake profile picture and mimic the face during video conference calls.

Wow! It’s truly sad that qualified people are struggling to get through interviews and hoops to get hired, but North Korean hackers are landing jobs.

By @tiimbz - 8 months
Related post from yesterday: We found North Korean engineers in our application pile [0]

[0] https://news.ycombinator.com/item?id=41353079

By @loandbehold - 8 months
Did these schmucks even understood what they were doing? Most likely they were recruited with "work from home" offer and thought they were doing legitimate jobs. They are victims themselves.
By @gundmc - 8 months
$250k/year for a job that they seemingly never needed to take a single meeting and can work remotely? Buried the lede here!
By @bitwize - 8 months
"Mom, I want the Dark Army from Mr. Robot."

"We have the Dark Army at home."

The Dark Army at home: