Two U.S. Nationals Sentenced for Running Laptop Farms in $5 Million DPRK Remote Worker Scheme

The U.S. Department of Justice has announced heavy prison terms for two New Jersey residents, Kejia Wang and Zhenxing Wang, who facilitated a long-running cyber-enabled employment fraud scheme that generated over $5 million for the Democratic People’s Republic of Korea (DPRK).

Kejia Wang was sentenced to 108 months in prison, while Zhenxing Wang received 92 months.

Both were ordered to serve three years of supervised release and forfeit $600,000 in illicit proceeds obtained through their facilitation of DPRK-linked remote IT operations.

Fraudulent Remote Workforce Scheme

According to investigators, the defendants played a central role in enabling dozens of North Korean operatives to illegally obtain remote employment with more than 100 U.S. companies, including several Fortune 500 corporations.

Over multiple years, the operation compromised the identities of at least 80 American citizens to pass routine employment verification checks.

The scheme used a complex physical infrastructure dubbed “laptop farms,” clusters of corporate-issued computers managed from the defendants’ own residences.

These devices created the illusion that DPRK-based workers were operating from inside the United States.

To bypass geolocation and security controls, the perpetrators connected the laptops to keyboard-video-mouse (KVM) switches, enabling remote control from overseas.

The setup allowed foreign operatives to appear as legitimate U.S.-based hires while secretly accessing sensitive corporate environments.

The defendants also established shell companies, including Hopana Tech LLC and Independent Lab LLC, to mask financial transactions and funnel stolen funds back abroad.

These firms conducted no genuine business operations and served primarily to launder proceeds from compromised employers.

Federal prosecutors revealed that this activity extended beyond financial manipulation. North Korean IT workers exploited legitimate access privileges to steal proprietary data and source code.

One incident involved a California defense contractor specializing in AI-powered defense systems, where technical data controlled under ITAR regulations was exfiltrated between January and April 2024.

Estimated damages from these intrusions exceed $3 million, covering network repairs and legal costs.

The sentencing marks a major success under the DPRK RevGen: Domestic Enabler Initiative, a Justice Department and FBI program targeting North Korean cyber revenue channels.

Authorities have seized 17 domains and 29 financial accounts tied to this network, while the U.S. State Department continues offering a $5 million reward for information about eight remaining fugitives.

Organizations are urged to guard against this threat by:

• Monitoring for unauthorized remote-access activity.
• Applying multi-factor identity verification during hiring.
• Auditing hardware for unapproved KVM connections.
• Reporting any suspicious IT employment anomalies to the FBI.

The case underscores how North Korea’s evolving cyber operations increasingly exploit trusted recruitment channels to infiltrate U.S. companies under the guise of legitimate remote work.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google

The post Two U.S. Nationals Sentenced for Running Laptop Farms in $5 Million DPRK Remote Worker Scheme appeared first on Cyber Security News.