North Korean fake remote worker scam lands two Americans 18-month prison sentences for hosting laptops — US firms unknowingly shipped laptops to “employees” who secretly worked from overseas via remote desktop, generating $1.2 million for Pyongyang

The U.S. Department of Justice announced on Wednesday that two American citizens have been sentenced to a combined three years in prison for facilitating a fraudulent remote IT worker scheme aimed at generating revenue for North Korea. The department announced the sentencing in two separate cases: one involving Matthew Isaac Knoot from Nashville, Tennessee, and the other, Erick Ntekereze Prince of New York.

In both cases, the men received and hosted laptops at their residences that U.S. companies had shipped, believing they were being sent to legitimate US-based IT workers they had hired. In the scheme, North Korean scammers posing as remote IT workers applied to numerous companies. Upon hiring, the companies sent out company-issued gadgets, as is common in the IT industry. The scammers provided the addresses of their American collaborators, who received and set up the laptops.

According to the announcement, Knoot and Prince installed RDP (Remote Desktop Protocol) applications on laptops, enabling their co-conspirators to work from overseas while appearing to work from the defendants' residences. The separate fraudulent schemes affected almost 70 victim companies in the U.S. and generated more than $1.2 million in revenue for North Korea.

“These defendants helped North Korean ‘IT workers’ masquerade as legitimate employees, compromising U.S. corporate networks and helping generate revenue for a heavily sanctioned and rogue regime. The National Security Division will continue to pursue those who, through deception and cyber-enabled fraud, threaten our national security,” said Assistant Attorney General for National Security John A. Eisenberg.

The defendants each received 18-month prison sentences. The Justice Department said these cases represent the 7th and 8th sentences secured in the last 5 months, as part of the nation's ongoing efforts to put an end to North Korea’s illicit revenue generation. Just last month, we reported that two U.S citizens received a combined 16-year prison sentence for running “North Korean laptop farms,” a similar scheme that needed 5 million in three years.

“These were not paperwork violations. They were deliberate acts that exposed U.S. businesses, compromised trust, and supported one of the world’s most dangerous adversaries. These sentences send a clear message: if you help foreign actors infiltrate American companies for profit, you will face federal prison and lose the money you made,” said U.S. Attorney Jason A. Reding Quiñones for the Southern District of Florida.