Justice Department indicts 14 North Koreans in connection to espionage ring that diverted $88 million for weapons and missiles

A cyberespionage ring linked to the North Korean regime used fake identities to have 14 of its citizens work remotely at U.S. tech companies, siphoning off more than $88 million between 2017 and 2023. According to a Department of Justice (DOJ) report, the proceeds were used to develop ballistic missiles and weaponry.

The scheme involved the theft of U.S. citizen identities and the use of local accomplices who facilitated fake job interviews. North Korean workers used remote access to not only obtain funds but also compromise secure systems and extort money from companies.

A federal court in St. Louis, Missouri, yesterday indicted 14 nationals of the Democratic People’s Republic of North Korea (DPRK or North Korea) with long-running conspiracies to violate U.S. sanctions and to commit wire fraud, money laundering, and identity theft. Specifically, the conspirators, who worked for DPRK-controlled companies Yanbian Silverstar and Volasys Silverstar, located in the People’s Republic of China (PRC) and the Russian Federation (Russia), respectively, conspired to use false, stolen, and borrowed identities of U.S. and other persons to conceal their North Korean identities and foreign locations and obtain employment as remote information technology (IT) workers for U.S. companies and nonprofit organizations.

Theft of sensitive corporate data

The scheme operated through a system in which U.S. accomplices acted as "proxies" during job interviews, while North Korean workers accessed corporate networks from overseas. In addition, to support their profiles, they created fake websites and resumes that duped multiple companies.

Investigations revealed that the workers also stole sensitive corporate data and threatened to publish it unless they received additional payments.

DOJ filed charges against the 14 involved

The DOJ filed charges against the 14 involved in Missouri federal court, charging them with money laundering, wire fraud, conspiracy and aggravated identity theft. Despite possible sentences of up to 27 years in prison, most of the defendants are in North Korea, making their capture difficult.

The authorities have seized $1.5 million and several internet domains related to the operation. However, FBI officials warn that this represents only a small part of the global network and have offered a reward of up to $5 million for information that would help disrupt this network or capture those responsible.