FBI Reveals: Remote IT Workers Funnel Millions to North Korean Weapons Program

FBI and Department of Justice officials revealed that over the course of several years, numerous information technology workers employed by U.S. companies have clandestinely funneled millions of dollars of their earnings to North Korea to support its ballistic missile program.

On Wednesday, the Justice Department disclosed that these IT workers, dispatched and contracted by North Korea to work remotely for companies in St. Louis and other parts of the United States, have used fabricated identities to secure their positions. The money they earned was surreptitiously diverted to fund North Korea’s weapons program, as confirmed by FBI leaders during a news conference held in St. Louis.

As part of an ongoing investigation, federal authorities announced the confiscation of $1.5 million in funds and the seizure of 17 domain names.

Jay Greenberg, the special agent in charge of the St. Louis FBI office, asserted that any company employing freelance IT workers had a high likelihood of hiring individuals participating in this illicit scheme. Greenberg emphasized that businesses should remain vigilant in verifying the identity of the individuals they hire, particularly when working with remote IT personnel. The FBI suggested that employers take proactive measures to make it more challenging for malevolent actors to conceal their identities.

While the companies that unwittingly hired North Korean workers and the inception date of this practice were not disclosed, court documents indicate that the North Korean government dispatched a substantial number of skilled IT workers primarily to China and Russia. Their goal was to deceive U.S. and international businesses into hiring them as freelance remote employees.

These IT workers generated substantial annual earnings that directly benefited North Korea’s weapons programs. In some instances, these workers infiltrated the computer networks of the companies that hired them, stealing sensitive information. They also maintained access to facilitate future hacking and extortion endeavors, as reported by the Justice Department.

These revelations come at a time when tensions on the Korean Peninsula are heightened, with North Korea conducting numerous missile tests since the beginning of 2022. The U.S. has responded by expanding military exercises with its Asian allies in a tit-for-tat fashion.

In September, North Korean leader Kim Jong Un called for a significant increase in the production of nuclear weapons and for his nation to play a larger role in a coalition of nations challenging the United States in what he termed a “new Cold War,” as reported by state media.

Furthermore, in February, United Nations experts reported that North Korean government-linked hackers had stolen record-breaking virtual assets in the previous year, estimated to be worth between $630 million and over $1 billion. These hackers employed increasingly sophisticated techniques to breach digital networks involved in cyberfinance and pilfer information useful for North Korea’s nuclear and ballistic missile programs from governments, individuals, and companies.