Justice Department Announces Court-Authorized Action to Disrupt Illicit Revenue Generation Efforts of Democratic People’s Republic of Korea Information Technology Workers · 2023-10-18 (press release date)
On Oct. 17, pursuant to a court order issued in the Eastern District of Missouri, the United States seized 17 website domains used by Democratic People’s Republic of Korea (DPRK) information technology (IT) workers in a scheme to defraud U.S. and foreign businesses, evade sanctions and fund the development of the DPRK government’s weapons program. These seizures follow the previously sealed October 2022 and January 2023 court-authorized seizures of approximately $1.5 million of the revenue that the same group of IT workers collected from unwitting victims as a result of their scheme, as well as the development of public-private information-sharing partnerships that denied the IT workers access to their preferred online freelance work and payment service providers.
23rd October – Threat Intelligence Report · 2023-10-23
The FBI has revealed that thousands of North Koreans had used false identities and other impersonation methods in order to find remote employment in IT jobs across the United States. The workers would then transfer their wages to North Korea’s ballistic missile weapons program. The Justice Department has announced that it had seized 17 domains and $1.5M as part of its investigation into the operation.
Seizure of twelve ".com" domain names used by Yanbian Silverstar North Korean IT workers (e.g., silverstarchina.com, xinlusoft.com, babyboxtech.com) · Filed 10/05/23
Specifically, the Subject Domain Names were used or intended to be used to commit IEEPA violations, acquired from identity theft, and facilitate money laundering of the group's freelancer revenue. ... The above shows the domain, babyboxtech.com, is controlled by North Korean IT workers working for Yanbian Silverstar. [Case No. 4:23-mj-09240, U.S. District Court for the Eastern District of Missouri; filing: Redacted Application and Affidavit for Search Warrant in case as to Twelve]
17 web domains used by IT workers to “defraud … businesses” seized by a Member State
Para 151: “Concurrently, one Member State also seized 17 web domains used by information technology workers to “defraud … businesses, evade sanctions and fund the development of the [Democratic People’s Republic of Korea] government’s weapons program”; the information technology workers “funneled” their income back to the Democratic People’s Republic of Korea through online payment services and third-country bank accounts.” Footnote 118: “Democratic People’s Republic of Korea information technology workers designed the domains to appear as those of legitimate United States-based information technology services companies.”