North Korea IT Worker Facilitation Scheme Disrupted in Nashville

Matthew Isaac Knoot, 38, of Nashville, Tennessee, was arrested today for his efforts to generate revenue for the Democratic People’s Republic of Korea’s (DPRK or North Korea) illicit weapons program, which includes weapons of mass destruction (WMD).

According to court documents, Knoot participated in a scheme to obtain remote employment with American and British companies for foreign information technology (IT) workers, who were actually North Korean actors. Knoot allegedly assisted them in using a stolen identity to pose as a U.S. citizen; hosted company laptops at his residences; downloaded and installed software without authorization on such laptops to facilitate access and perpetuate the deception; and conspired to launder payments for the remote IT work, including to accounts tied to North Korean and Chinese actors.

“As alleged, this defendant facilitated a scheme to deceive U.S. companies into hiring foreign remote IT workers who were paid hundreds of thousands of dollars in income funneled to the DPRK for its weapons program,” said Assistant Attorney General Matthew G. Olsen of the Justice Department’s National Security Division. “This indictment should serve as a stark warning to U.S. businesses that employ remote IT workers of the growing threat from the DPRK and the need to be vigilant in their hiring processes.”

“North Korea has dispatched thousands of highly skilled information technology workers around the world to dupe unwitting businesses and evade international sanctions so that it can continue to fund its dangerous weapons program,” said U.S. Attorney Henry C. Leventis for the Middle District of Tennessee. “Today’s indictment, charging the defendant with facilitating a complex, multi-year scheme that funneled hundreds of thousands of dollars to foreign actors, is the most recent example of our office’s commitment to protecting the United States’ national security interests.”

“As today’s charges demonstrate, the FBI will relentlessly pursue those who aid the North Korean government’s illegal efforts to generate revenue,” said Assistant Director Bryan Vorndran of the FBI’s Cyber Division. “Where illicit proceeds may be used to fund the regime’s kinetic capacity, we will prioritize our work to disrupt that flow of money. This indictment should demonstrate the risk faced by those who support the DPRK’s malicious cyber activity.”

The DPRK has dispatched thousands of skilled IT workers to live abroad, primarily in China and Russia, with the aim of deceiving U.S. and other businesses worldwide into hiring them as freelance IT workers to generate revenue for its WMD programs. DPRK IT worker schemes involve the use of pseudonymous email, social media, payment platform and online job site accounts, as well as false websites, proxy computers, and witting and unwitting third parties located in the United States and elsewhere.

According to the indictment, Knoot participated in a scheme to assist overseas IT workers to obtain remote IT work at U.S. companies which believed they were hiring legitimate workers. Knoot allegedly conspired to launder payments for the remote IT work, including to accounts tied to North Korean and Chinese actors. The indictment alleges that the scheme generated hundreds of thousands of dollars in income for the DPRK’s weapons program.

The FBI, along with the Departments of State and Treasury, issued a May 2022 advisory to alert the international community, private sector, and public about the North Korea IT worker threat. Updated guidance was issued in October 2023 by the United States and the Republic of Korea (South Korea) and in May 2024 by the FBI, which include indicators to watch for that are consistent with the North Korea IT worker fraud and the use of U.S.-based laptop farms.

MORE FEDERAL CRIME NEWS

Cybercrime

Emeka Ndukwu, Money Laundering Conspiracy, District of Columbia 2018

Apr 24, 2018

Cybercrime

Justin Packham, Possession of Child Pornography, Kansas 2022

Apr 6, 2026

Cybercrime

Steven Raymon Waller, Access Device Fraud, California 2023

Dec 18, 2024

Cybercrime

George Bridi, Conspiracy to Commit Copyright Infringement, New York 2024

Nov 18, 2021