Two Americans have been sentenced to prison for operating illegal “laptop farms” that helped North Korean IT operatives secretly secure remote jobs with dozens of U.S. companies in a cyber fraud scheme worth over $1.2 million.
The United States Department of Justice announced on Wednesday that Matthew Issac Knoot of Tennessee and Erick Ntekereze Prince of New York were each sentenced to 18 months imprisonment for aiding North Korean workers linked to the Democratic People’s Republic of Korea (DPRK).
According to U.S. authorities, the two men helped North Korean operatives pose as legitimate remote employees by receiving company-issued laptops at American addresses and installing remote desktop software that allowed foreign workers to secretly access the devices from overseas.
Investigators said the scheme affected nearly 70 American companies and generated huge financial gains for North Korea, a country heavily sanctioned by the United States over its nuclear weapons programme.
Assistant Attorney General for National Security, John A. Eisenberg, said the convictions send a strong warning to anyone assisting foreign cybercrime operations.
“These defendants helped North Korean IT workers disguise themselves as legitimate employees, exposing U.S. corporate networks and generating revenue for a rogue regime,” Eisenberg stated.
Authorities revealed that Prince used his company, Taggcar Inc., to recruit and place fake “certified” IT workers in American firms between 2020 and 2024 despite allegedly knowing they were operating outside the U.S. using stolen identities.
Federal prosecutors said Prince and his associates secured jobs for North Korean operatives at more than 64 companies, generating over $943,000 in salary payments. Much of the money was reportedly transferred abroad.
U.S. District Judge Darrin P. Gayles sentenced Prince to 18 months in prison, three years supervised release, and ordered him to forfeit $89,000 linked to the operation.
Authorities also disclosed that the cyber scheme forced several victim companies to spend more than $1 million on cybersecurity audits and remediation efforts.
In a separate case, Matthew Knoot was sentenced by U.S. District Judge Eli Richardson after investigators discovered he operated a similar “laptop farm” from residences in Nashville, Tennessee.
Court documents showed that between July 2022 and August 2023, companies unknowingly shipped work laptops to Knoot’s address under a fake identity known as “Andrew M.” Knoot allegedly installed unauthorised software that enabled a North Korean operative based in China to remotely access the systems while appearing to work from Tennessee.
The operation reportedly secured employment from at least four American companies and generated more than $250,000 in payments.
Knoot was sentenced to 18 months imprisonment, one year supervised release, and ordered to pay restitution and forfeiture totaling over $30,000.
Federal investigators further accused him of lying to the FBI and destroying evidence during the investigation.
The FBI warned that Americans who assist foreign cyber operatives would face severe consequences.
FBI Cyber Division Assistant Director Brett Leatherman said the agency would continue disrupting North Korea’s efforts to evade sanctions and finance its regime through cyber-enabled fraud.
The convictions were secured under the U.S. government’s “DPRK RevGen: Domestic Enabler Initiative,” a joint operation between the FBI and the Department of Justice aimed at dismantling North Korea’s illicit cyber revenue networks.
U.S. officials have repeatedly warned that North Korean IT workers often use stolen identities, fake documents, and proxy systems to infiltrate foreign companies, steal sensitive data, and generate funds for the country’s weapons programmes.
American authorities say some North Korean IT operatives earn as much as $300,000 annually, generating hundreds of millions of dollars for the regime each year.
