(Credit: Michaklootwijk via Getty Images)
The US is offering rewards of up to $5 million for information that will help stop a group of North Koreans from gaining remote IT jobs at American companies.
The State Department announced the award today as federal prosecutors charged an Arizona woman, 49-year-old Christina Chapman, for allegedly helping North Koreans find jobs as remote software and application developers from October 2020 to October 2023.
The North Koreans—who go by Jiho Han, Chunji Jin, Haoran Xu, and Zhonghua—snagged remote jobs at various US companies using identities belonging to more than 60 real US persons.
"They also attempted — but failed — to gain similar employment at two US government agencies,” the State Department added. All three North Koreans also allegedly have ties with the country’s Munitions Industry Department, which oversees the development of ballistic missiles and weapons production.
The scheme was lucrative enough for the group to generate at least $6.8 million for North Korea, which is facing strict sanctions from the US and Western governments over its nuclear weapons testing. The US added that the Arizona woman, Chapman, allegedly played a key role by supplying the North Koreans with valid identity information from real Americans and even laundering their earnings from US companies.
“She also received and hosted laptop computers issued to the IT workers by US employers to make it appear that the overseas workers were located in the United States and assisted the workers in connecting remotely to the US companies’ IT networks on a daily basis,” the State Department said.
Federal investigators arrested Chapman on Wednesday in Litchfield Park, Arizona. She faces a maximum penalty of 97.5 years if convicted of all charges.
Anyone with information on "Jiho Han, Haoran Xu, Chunji Jin, Zhonghua, associated individuals or entities, or their revenue-generating and money laundering activities" is encouraged to submit it via Signal, Telegram, WhatsApp, or the Tor Browser.
The US is concerned the scheme helped generate funds for the North Korean government and its weapons programs. In October, the FBI and Justice Department warned about the threat, saying they had seized 17 websites that North Korea had exploited to trick US companies and foreign firms into paying for the remote IT worker services.
"The charges in [the Chapman] case should be a wakeup call for American companies and government agencies that employ remote IT workers," says US Assistant Attorney General Nicole Argentieri. "These crimes benefited the North Korean government, giving it a revenue stream and, in some instances, proprietary information stolen by the co-conspirators.”
In connection with the alleged crimes, federal prosecutors also charged a 27-year-old Ukrainian man named Oleksandr Didenko for allegedly creating fake accounts at freelance IT job platforms and selling access to them, including to North Koreans.
“Didenko ran ‘UpWorkSell,’ which used a publicly available website to advertise the ability for remote IT workers to buy or rent accounts using identities other than their own on various platforms,” the Justice Department added. “The UpWorkSell website also advertised ‘Credit Card Rental’ in the European Union and the United States, SIM card rental for cellular phones, and the ability to buy or rent accounts at online money service transmitters located in the United States and abroad.”
The US has since seized the domain for UpWorkSell. European police also arrested Didenko while he was in Poland. The US is currently seeking his extradition.