Arizona woman charged in North Korean IT worker scheme that raised millions
![<i>Greg Baker/AFP/Getty Images via CNN Newsource</i><br/>The North Korean flag flies above the North Korean embassy in Beijing in September 2016. US federal prosecutors on May 16 charged an Arizona woman in a North Korean IT worker scheme that raised millions.](https://ktvz.b-cdn.net/2024/05/cnn-L19jb21wb25lbnRzL2ltYWdlL2luc3RhbmNlcy9jbHc5ZnJyYnQwMDBqM2I2ajEyZG85dDBq-L19jb21wb25lbnRzL2FydGljbGUvaW5zdGFuY2VzL2Nsdzlmamg3aDAwMG01bXA3ZHFhczBzYzE-300-scaled.jpg)
The North Korean flag flies above the North Korean embassy in Beijing in September 2016. US federal prosecutors on May 16 charged an Arizona woman in a North Korean IT worker scheme that raised millions.
(CNN) — USĀ federal prosecutors on Thursday charged an Arizona woman with participating in an elaborate fraud scheme to help foreign IT workers pose as Americans, get hired by major US companies and earn $6.8 million in revenue that could benefit the nuclear-armed North Korean regime.
The scheme compromised the identities of 60 Americans and affected 300 US companies, including a major national TV network, a āpremierā Silicon Valley tech company, and an āiconicā American car maker, says an indictment unsealed in the US District Court for the District of Columbia. The indictment did not name of the companies.
The Arizona woman, Christina Chapman, is accused of running a ālaptop farmā from her home, in which she logged into US company-issued laptops on behalf of the foreign IT workers to trick companies into believing the workers were living in the US. At least some of the workers are described as North Korean nationals in the indictment.
The court documents shed light on a broader phenomenon that US national officials have been trying to thwart for years: How thousands of North Korean overseas IT workers are trying to subvert sanctions and send untold amounts of money back to Pyongyang.
Chapman is charged with nine counts including conspiracy to defraud the US. She has been arrested and is expected to make her initial court appearance in Arizona on Thursday, a law enforcement official familiar with the matter told CNN. Court records did not identify a lawyer for Chapman.
āThe conspiracy perpetrated a staggering fraud on a multitude of industries, at the expense of generally unknowing U.S. companies and persons,ā the indictment says.
The overseas IT workers also āattempted to gain employment and access to information at two different U.S. government agencies on three different occasions,ā the indictment says, not naming the agencies. Those attempts were ādiscovered and thwarted,ā prosecutors said.
In a separate criminal complaint unsealed Thursday, a Ukrainian man named Oleksandr Didenko was accused of operating at least three ālaptop farmsā comprised of 79 computers in San Diego; Jefferson City, Tennessee; and Virginia Beach, Virginia. Didenko ran a business that allowed clients, including overseas IT workers, to use false identities to get hired for remote work, prosecutors alleged. A person who gave their name as Christina Chapman was among the people that Didenko shipped a laptop to, according to the complaint.
When the FBI used a warrant to search Chapmanās residence in October, agents found more than 90 computers, the complaint says. Three jobs filled by North Korean IT workers at US companies were tied through business records to the computers found in Chapmansā residence, according to the complaint.
Didenko is accused of aggravated identity theft and wire fraud among other charges. He is not yet in custody in the US, the law enforcement official told CNN.
North Korean IT workers generally pose as other nationalities, offer to work remotely and apply for jobs in gaming, IT support, and artificial intelligence, among other sectors, according to a 2022Ā public warningĀ from the State Department and other agencies.
FBI agents and State and Treasury officials have been quietly trying to raise awareness of the North Korean insider threat by conducting briefings for business executives and chasing down leads about potential North Korean IT workers at US companies.
Some of these IT workers work closely with North Korean hackers, who are also a rich source of revenue for the regime, according to experts. About half ofĀ North KoreaāsĀ missile program has been funded by cyberattacks and cryptocurrency theft,Ā a White House officialĀ saidĀ last year.
āBy directing its IT workers to gain employment at Western companies, North Korea has weaponized its tech talent and created the ultimate insider threat,ā Michael Barnhart, a North Korea specialist at Google-owned cybersecurity firm Mandiant, told CNN.
āThese operatives bypass sanctions by diverting their paychecks to help fund North Koreaās nuclear program. Simultaneously, theyāre providing a foothold into major organizations for North Koreaās more advanced threat groups,ā Barnhart said.
A previous CNNāÆinvestigation found that the founder of a California-based cryptocurrency startup had unwittingly paid tens of thousands of dollars to a North Korean engineer. The entrepreneur was unaware of the situation until the FBI notified him, he said.
And North Korean illustrators and graphic designers appear to have helped produce work for US animation studios unbeknownst to those companies, independent researchersĀ told CNN last month.Ā The researchers discovered a trove of cartoon sketches on an open computer server on the North Korean portion of the internet.
The State Department on Thursday offered $5 million in rewards for āinformation that leads to the disruptionā of North Korean money laundering or other financial fraud.
The State Department rarely reveals details of the fruits of its āRewards for Justiceā program, which the department says has paid about $250 million to some 125 people worldwide over the last 40 years for tips that helped apprehend terrorists and counter national security threats. But the department did say on Thursday that it had paid $5 million each to two unnamed people whose information āhelped disrupt an illicit financial scheme that benefitedā North Korea.
The-CNN-Wire
™ & © 2024 Cable News Network, Inc., a Warner Bros. Discovery Company. All rights reserved.