FOLLOW US

Four U.S. citizens and one Ukrainian national have pleaded guilty in federal court to participating in a covert scheme that helped North Korean workers illegally secure remote IT jobs with American companies, the U.S. Department of Justice announced Friday. The pleas came alongside two sweeping forfeiture complaints targeting over $15 million in stolen virtual currency from Pyongyang-backed cyber operations, including funds seized by the FBI earlier this year.

According to prosecutors, the operation functioned like a shadow pipeline—North Korean workers masqueraded as U.S.-based tech professionals using stolen identities, while the illicit earnings helped bankroll the regime’s weapons programs in defiance of international sanctions.

“These actions demonstrate the department’s comprehensive approach to disrupting North Korean efforts to finance their weapons program on the backs of Americans,” Assistant Attorney General John A. Eisenberg said.

How the Fraud Worked

Stolen Identities, Hosted Laptops, and Faked Locations

Court filings show that the U.S.- and Ukraine-based facilitators provided their own identities—or those stolen from innocent Americans—to North Korean operatives applying for remote jobs. They also hosted company-issued laptops at their homes across the United States, creating the illusion that the IT workers were operating domestically.

The DOJ says the scheme targeted 136 U.S. companies, generated roughly $2.2 million for the DPRK, and compromised the identities of more than 18 U.S. individuals.

A 2022 advisory from the FBI, Treasury, and State Department previously warned that North Korean IT workers can earn up to $300,000 annually, collectively funneling hundreds of millions into programs run by the DPRK Ministry of Defense.

Guilty Pleas Across Multiple Districts

Georgia Defendants Faked Drug Tests, Hosted Equipment

In the Southern District of Georgia, Audricus Phagnasay, 24; Jason Salazar, 30; and Alexander Paul Travis, 34, pleaded guilty Thursday to conspiracy to commit wire fraud. Between 2019 and 2022, the trio supplied their American identities to overseas IT workers, hosted corporate laptops, and installed unauthorized remote-access tools.

Travis—then an active-duty U.S. Army member—and Salazar even appeared for drug tests on behalf of the North Korean workers. Travis earned over $51,000, while Phagnasay and Salazar made $3,450 and $4,500, respectively.

Florida Defendant Ran Fake IT Staffing Firm

In Florida, Erick Ntekereze Prince, 30, also pleaded guilty to wire fraud conspiracy. Through his company Taggcar Inc., Prince claimed to supply “certified” IT professionals to U.S. clients, but prosecutors say he instead funneled work to foreign North Korean IT operatives using stolen identities. Prince earned nearly $89,000 from the scheme.