Fourteen North Korean citizens are accused of a years-long fraud scheme. These «IT warriors,» hiding their whereabouts, took jobs as remote IT workers for U.S. companies and nonprofits.
Fourteen North Korean citizens are accused of a years-long fraud scheme. These «IT warriors,» hiding their whereabouts, took jobs as remote IT workers for U.S. companies and nonprofits.
North Korean (DPRK) technicians have been sending their «earned» money back to Pyongyang for the ultimate benefit of the DPRK government. Some «IT warriors» also use their access privileges to steal information, such as their own source code, and then demand that their employers threaten to expose corporate assets if they are not paid to remain silent, The Register reports .
According to the Department of Justice, one of the players, Yanbian Silverstar, is in China, and the other, Volasys Silverstar, is in Russia.
Both are accused of using «false, stolen and borrowed identities» to obtain remote jobs — an effort that the Justice Department says generated «at least $88 million over an approximately six-year conspiracy,» though that amount does not include extortion. The indictment details how the conspiracy targeted six U.S. companies, as well as two nonprofits.
The indictment alleges that the two companies employed at least 130 techies, who were known internally as «IT warriors» and aimed to earn $10,000 each month.
The conspirators also allegedly created websites that appeared to be agencies providing contract or freelance IT workers. These fake companies included Eden Programming Solutions, Purpleish Tech, Culture Box, Next Nets, Illusion Software, Baby Box Tech, Cubix Tech, and Helix.
Google’s intelligence subsidiary Mandiant told The Register that in recent months there has been «an increase in extortion attempts involving North Korean IT workers. And for the first time, we are seeing IT workers revealing sensitive data from the organizations they work for. They have been infiltrated to force victims to pay exorbitant ransoms.»
«Yesterday’s (December 11 — ed.) indictment is the latest in a series of actions under a Homeland Security Department initiative launched earlier this year to disrupt North Korea’s efforts to generate revenue by deceiving U.S. companies into hiring its citizens to work remotely,» the U.S. Department of Justice wrote, citing Assistant Attorney General Matthew G. Olsen. According to him, this indictment and related violations highlight the cybersecurity dangers associated with this threat, including the theft of confidential business information for the purpose of extortion.
The United States on Thursday (December 12) offered a reward of up to $5 million for information on two North Korean information technology (IT) firms, accusing them of exploiting workers for profit to prop up the regime in Pyongyang.
The State Department also released the names of 14 people, including Jeon Seong-hwa, CEO of both companies, as well as Yanbian Silverstar President Kim Ryu-sung and Volasys Silverstar President Ri Kyung-sik.
«These IT companies were engaged in exporting North Korean IT workers, managers, and support staff to Yanji in China’s Jilin Province and Vladivostok, Russia, to generate revenue by deceiving American and other companies around the world into hiring them as freelance IT workers,» the report said.
