The U.S. State Department is offering a reward of up to $5 million for information about North Korea's IT worker farms, which generated more than $88 million through illegal remote IT work programs over six years.
See also: Radiant Capital: North Korean hackers stole $50 million worth of crypto
The two companies, China-based Yanbian Silverstar and Russia-based Volasys Silverstar , tricked businesses around the world into employing North Korean personnel as independent IT workers .
These illegally obtained funds are then laundered in violation of international sanctions and sent back to the Pyongyang regime to support the country’s UN-banned nuclear and missile programs. As the FBI, State Department, and Justice Department said in a joint advisory in May 2022, each North Korean IT worker can earn up to $300,000 per year, collectively earning hundreds of millions of dollars each year.
The Justice Department also charged 14 North Korean “cyber warriors” associated with Yanbian Silverstar and Volasys Silverstar with participating in conspiracies to violate U.S. sanctions and for identity theft, online fraud, and money laundering.
Led by Jong Song Hwa, the CEO of Yanbian Silverstar and Volasys Silverstar, the IT worker farms have raised at least $88 million in about six years.
See also: North Korean hackers Sapphire Sleet have stolen $10 million worth of crypto.
Previous Justice Department actions targeting this group include the seizure of approximately $320,000 in January, another approximately $444,800 in July, seizures of approximately $1.5 million in October 2022 and January 2023, and the seizure of 29 internet domains in October 2023 and May 2024.
When communicating with prospective employers, malicious actors used dozens of such domains to make their stolen identity appear more legitimate.
They also used them to register domain names to host websites that helped deceive U.S. employers into believing they previously worked for other reputable U.S. companies, and to create accounts to collect the funds they earned from employers, which were later transferred to accounts controlled by North Korea.
After being discovered and fired, some of the North Korean IT workers used confidential knowledge and coding skills to blackmail their former employers, threatening to leak stolen sensitive information online.
See also: North Korean companies impersonate US IT companies
IT worker farms refer to centers or companies that employ a large number of IT workers to perform tasks and projects at scale. Often, however, these workers are used to carry out illegal activities, impersonating people they are not. Their ultimate goal is to defraud employers and obtain money to fund fraudulent activities.
Source: bleepingcomputer
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
