Federal authorities have unraveled several schemes by the Democratic People’s Republic of North Korea (DPRK) that were used to fund its regime through remote information technology (IT) work for U.S. companies, resulting in two indictments, tech and financial seizures and an arrest.

The Department of Justice (DOJ) said Monday that North Korean actors were helped by individuals in the U.S., China, the United Arab Emirates and Taiwan to obtain employment with over 100 U.S. companies, including Fortune 500 companies.

In one scheme, U.S.-based individuals created front companies and fraudulent websites to promote the legitimacy of remote workers, while hosting laptop farms where remote North Korean IT workers could remotely access company-provided laptop computers.

In another scheme, IT workers in North Korea used false identities to gain employment with a blockchain research and development company in Atlanta, Georgia, and steal virtual currency worth over $900,000.

Inside a courtroom with gavel in plain view.  (iStock)

The indictment alleges the four defendants traveled to the United Arab Emirates on North Korean travel documents and worked as a co-located team.

Jin and Ju were also allegedly hired by a blockchain research and development company in Atlanta, and a virtual token company based in Serbia.

While hired, Jin and Ju hid their North Korean identities from their employers and provided false identification documents, the DOJ alleged.

Both defendants ultimately earned the trust of their employers and allegedly stole hundreds of thousands of dollars from them in multiple instances. The funds were then laundered and transferred to accounts held by Bok and Nam, which were allegedly opened fraudulently using Malaysian identification documents.

During the investigation, the FBI executed searches of 21 premises across 14 states that were hosting known and suspected laptop farms. During the execution, the FBI seized 137 laptops.