Two US nationals have been imprisoned for their role in helping to facilitate laptop farms for North Korean remote IT worker scams on behalf of Pyongyang.

On April 15, the US Justice Department, announced that Kejia Wang, 42, and Zhenxing Wang, 39, had been sentenced for their part in a scheme which, over several years, deceived more than one hundred American companies into employing North Korean workers posing as US residents.

The scheme used the stolen identities of at least 80 American citizens to generate more than $5m in illicit revenue for the government of the Democratic People’s Republic of Korea (DPRK). The activity also allowed the perpetrators to access and steal sensitive data and source code from firms including from military contractors and AI companies.

Kejia Wang, of Edison, New Jersey, was sentenced to 108 months in prison, while Zhenxing Wang, of New Brunswick, New Jersey, was sentenced to 92 months in prison. Both had pleaded guilty to charges of conspiracy to commit wire fraud and conspiracy to commit money laundering. Zhenxing Wang also pleaded guilty to conspiracy to commit identity theft.

Fortune 500 Companies Fell Victim

According to the released court documents, the stolen identities were used to apply for and obtain remote IT worker roles at more than 100 organizations, including several Fortune 500 companies.

Keija Wang is said to have acted as manager of the scheme within the US, supervising at least five individuals involved in working in fake roles.

Both Kejia Wang and Zhenxing Wang used their home addresses to receive laptops which were intended for use by who the companies believed were the legitimate remote workers they had hired

In addition, both individuals provided overseas IT workers in North Korea remote access to the laptops.

Read more: How to Protect Your Business From North Korean IT Worker Scams

To hide the scheme, shell companies with corresponding financial accounts were created. This helped to make it appear as though the overseas IT workers were affiliated with legitimate US businesses.

This allowed Kejia Wang and Zhenxing Wang to receive hundreds of millions of dollars from legitimate US businesses who believed they were transferring the salaries of remote workers. Much of this money was laundered and sent to North Korea.

“Today’s announcement sends a clear message: US nationals who facilitate DPRK IT worker schemes and funnel revenue to North Korea will face FBI investigation and potential prison time,” said Assistant Director Brett Leatherman of the FBI’s Cyber Division.

“Working closely with our partners, the FBI will pursue their co-conspirators and hold accountable those who seek to empower the DPRK by defrauding American companies and stealing the identities of private citizens.”

Eight other individuals who have been indicated for their part in the scheme remain at large and wanted by the FBI.