DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

Phagnasay, Salazar and Travis identity-lending IT worker scheme (S.D. Ga.)

Date (as written)
From approximately September 2019 through November 2022
Year
2019
Country
United States
Actors (as written)
overseas IT workers (DPRK scheme)
Actor pages
overseas IT workers
Tags (as written)
IT workers; identity
Dollar figures (as written)
over $193,000; at least $51,397; $193,000; $51,397.

Source entries (2)

US court filing via CourtListener RECAP: United States v. Travis

Alexander Paul Travis (Fort Gordon, Georgia) allowed his identity to be used by overseas DPRK IT workers; hosted laptops · From on or about September 9, 2019, until November 8, 2022
From on or about September 9, 2019, until November 8, 2022, in Fort Gordon, Georgia ... The Defendant's actions caused eight U.S. companies to hire one or more overseas IT workers and pay those individuals a combined total of over $193,000 in salary. For his participation in this scheme, the Defendant received at least $51,397. [Case No. 1:25-cr-00059, U.S. District Court for the Southern District of Georgia; filing: INFORMATION as to Alexander Paul Travis]
https://storage.courtlistener.com/recap/gov.uscourts.gasd.115868/gov.uscourts.gasd.115868.1.0.pdf

DOJ OPA press release: Nationwide actions to combat illicit North Korean government revenue generation (2025-11-14)

Phagnasay, Salazar and Travis identity-lending IT worker scheme (S.D. Ga.) · From approximately September 2019 through November 2022
From approximately September 2019 through November 2022, Phagnasay, Salazar, and Travis provided their U.S. identities to IT workers they knew were located outside the United States so that the workers could fraudulently apply for and obtain employment with victim U.S. companies.
https://www.justice.gov/opa/pr/justice-department-announces-nationwide-actions-combat-illicit-north-korean-government

Suggest a correction on GitHub