A recent report by the Asian Nikkei Review reveals that North Korean engineers are leveraging artificial intelligence and sophisticated deception techniques to secure remote jobs with foreign governments and corporations, ultimately funneling U.S. dollars into the regime of Kim Jong-un.

The investigation highlights the case of Matthew Isaac Knoot, a 38-year-old from Nashville, Tennessee, who allegedly operated a “laptop farm” aimed at generating revenue for North Korea’s weapons program. Knoot reportedly used stolen identities to mislead American and British companies into hiring North Korean workers disguised as remote IT personnel. The proceeds from these fraudulent operations were laundered into accounts linked to both North Korean and Chinese entities.

According to the Attorney’s Office for the Middle District of Tennessee, Knoot’s operation garnered over $250,000 in revenue between July 2022 and August 2023 from each false worker employed. Authorities dismantled Knoot’s operation in August, leading to charges of aggravated identity theft and conspiracy to unlawfully employ aliens, with a maximum penalty of 20 years in prison looming if he is found guilty.

This incident is not an isolated case. It exemplifies a broader trend where North Korean actors infiltrate U.S. tech companies using forged or stolen identities, all in an effort to finance the regime’s activities or facilitate cyberattacks. In a report published by Google’s security subsidiary, Mandiant, a North Korean hacker group known as “UNC5267” was identified as actively attempting to breach U.S. tech firms. This decentralized group, operating since at least 2018, has members living in various countries, including China, Russia, and parts of Africa and Southeast Asia.

Lili Infante, founder and CEO of Miami-based cybersecurity startup CAT Labs, spoke about the challenges her firm has faced, stating, “We’ve weeded out over 50 candidates that were North Korean spies. I had to implement specific controls in my hiring process.”

In a similar vein, cybersecurity firm KnowBe4 reported in July that it had detected a North Korean spy posing as a remote software engineer within its ranks. The company noted that the individual passed several background checks, illustrating the sophistication of these infiltration tactics.

The techniques employed by North Korean operatives are becoming increasingly advanced, with reports indicating that some individuals juggle multiple remote jobs simultaneously, generating millions of dollars for the regime. As the threat of infiltration continues to grow, U.S. companies are urged to enhance their vetting processes to safeguard against these deceptive tactics.