Nashville man arrested for aiding North Korean remote IT worker fraud

Matthew Knoot allegedly ran a laptop farm that funneled hundreds of thousands of dollars back to North Korea.

A Nashville resident was arrested Thursday on charges of facilitating a remote IT-worker scheme that funneled hundreds of thousands of dollars to North Korea’s illicit weapons program. 

Matthew Isaac Knoot, 38, allegedly assisted North Korean IT workers in getting hired by U.S. and British companies under false identities. The indictment, unsealed in the Middle District of Tennessee, details a complex operation where Knoot allegedly used stolen identities to obtain remote work for North Korean nationals, who were masquerading as U.S. citizens. 

These workers, based abroad, gained six-figure salaries which were laundered through international transfers to disguise their origins. Knoot, acting alongside others, including a facilitator named Yang Di, allegedly enabled these schemes through the use of unauthorized software installations on company-provided laptops. While the work was completed on U.S.-based computers, Knoot and co-conspirators earned a percentage of the salary, with the rest sent abroad. 

Knoot faces multiple charges, including conspiracy to damage protected computers and money laundering, carrying a maximum potential sentence of 20 years in prison if convicted.

The recurrence of these North Korean-led remote work schemes has been a problem for both the U.S. government and the cybersecurity industry. In May, the Justice Department charged an Arizona woman in a similar scheme that defrauded over 300 U.S. companies through U.S.-based payment platforms, online job site accounts, and proxy computers. In July, security awareness training company KnowBe4 revealed that it had discovered and removed a newly hired software engineer on its internal IT team after it realized it was actually a persona controlled by a North Korean threat actor.

Earlier this week, CrowdStrike detailed in its 2024 Threat Hunting Report that remote IT workers with ties to North Korea targeted more than 30 U.S.-based companies, including aerospace, defense, retail and technology organizations.

“This indictment should serve as a stark warning to U.S. businesses that employ remote IT workers of the growing threat from the DPRK and the need to be vigilant in their hiring processes,” Assistant Attorney General Matthew G. Olsen said in a press release. 

You can read the full indictment here. 

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

• FBI raises alarm over deceptive phishing campaign targeting prominent people

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure