Infiltrating the IT industry

Companies across the globe have unknowingly hired remote information technology workers acting on behalf of the Democratic People’s Republic of Korea (DPRK). Using stolen identities and gaining access to sensitive data, the workers illicitly generate revenue for the DPRK’s Weapons of Mass Destruction (WMD) and ballistic missiles programs (weapons program). The author breaks down elements of the scheme and provides tactics for organizations to avoid hiring bad actors.

Matthew Knoot allegedly had a farm. Not the kind with fields of crops, but a “laptop farm,” with a series of computers that he reportedly tended from his residences in the U.S. state of Tennessee. His objective, according to the U.S. Department of Justice (DOJ), was to provide a command center for a vast network of remote workers primarily in Russia and China who were illegally employed in information technology (IT) jobs at hundreds of U.S. and British companies.