Arizona woman charged in North Korean IT worker scheme that raised millions

US federal prosecutors on Thursday charged an Arizona woman with participating in an elaborate fraud scheme to help foreign IT workers pose as Americans, get hired by major US companies and earn $6.8 million in revenue that could benefit the nuclear-armed North Korean regime.

The scheme compromised the identities of 60 Americans and affected 300 US companies, including a major national TV network, a “premier” Silicon Valley tech company, and an “iconic” American car maker, says an indictment unsealed in the US District Court for the District of Columbia. The indictment did not name of the companies.

The Arizona woman, Christina Chapman, is accused of running a “laptop farm” from her home, in which she logged into US company-issued laptops on behalf of the foreign IT workers to trick companies into believing the workers were living in the US. At least some of the workers are described as North Korean nationals in the indictment.

Chapman is charged with nine counts including conspiracy to defraud the US. Court records did not identify a lawyer for Chapman.

The overseas IT workers also “attempted to gain employment and access to information at two different U.S. government agencies on three different occasions,” the indictment says, not naming the agencies. Those attempts were “discovered and thwarted,” prosecutors said.

The indictment sheds light on a broader phenomenon that US national officials have been trying to thwart for years: How thousands of North Korean overseas IT workers are trying to subvert sanctions and send money back to Pyongyang.

The IT workers pose as other nationalities, offer to work remotely and apply for jobs in gaming, IT support, and artificial intelligence, among other sectors, according to a 2022 public warning from the State Department and other agencies.

Some of these IT workers work closely with North Korean hackers, who are also a rich source of revenue for the regime, according to experts. About half of North Korea’s missile program has been funded by cyberattacks and cryptocurrency theft, a White House official said last year.

A previous CNN investigation found that the founder of a California-based cryptocurrency startup had unwittingly paid tens of thousands of dollars to a North Korean engineer. The entrepreneur was unaware of the situation until the FBI notified him, he said.

And North Korean illustrators and graphic designers appear to have helped produce work for US animation studios unbeknownst to those companies, independent researchers told CNN last month. The researchers discovered a trove of cartoon sketches on an open computer server on the North Korean portion of the internet.