The US Justice Department on Monday announced a major operation targeting a North Korean scheme that infiltrated over 100 US companies, including Fortune 500 firms, to generate funds for the Democratic People’s Republic of Korea’s (DPRK) weapons programs.
The operation resulted in the arrest of US national Zhenxing “Danny” Wang in New Jersey and indictments against six Chinese nationals—Jing Bin Huang, Baoyu Zhou, Tong Yuze, Yongzhe Xu, Ziyou Yuan, and Zhenbang Zhou—and two Taiwanese nationals, Mengting Liu and Enchia Liu.
The defendants are accused of facilitating North Korean operatives in securing remote IT jobs using stolen identities of over 80 US citizens, generating over $5 million in revenue.
According to the indictment, from 2021 to October 2024, the scheme involved US-based facilitators who set up “laptop farms” to host company-issued laptops, enabling North Korean workers to access US networks remotely while appearing to operate domestically.
The operatives used fake websites, shell companies, and compromised identities to deceive employers, with some stealing sensitive data, including export-controlled US military technology and over $900,000 in cryptocurrency from a Georgia-based company.
The Justice Department’s actions included searches of 29 laptop farms across 16 states, seizing 137 laptops, 29 financial accounts, 21 fraudulent websites, and 17 web domains.
Assistant Attorney General John Eisenberg stated, “These schemes target and steal from US companies and are designed to evade sanctions and fund the North Korean regime’s illicit programs, including its weapons programs.” US Attorney Leah Foley for the District of Massachusetts emphasized the scale of the threat, noting, “Thousands of North Korean cyber operatives have been trained and deployed by the regime to blend into the global digital workforce.” The FBI also reported increased extortion attempts by North Korean IT workers, who leverage unauthorized network access to steal proprietary data.
China’s Foreign Ministry, responding to the indictments, opposed the US actions, with spokeswoman Mao Ning stating, “China has always opposed unilateral sanctions that have no basis in international law” and vowed to protect its citizens’ rights.
The operation is part of the Justice Department’s “DPRK RevGen: Domestic Enabler Initiative,” launched in March 2024, which has led to multiple prosecutions, including a December 2024 indictment of 14 North Koreans for generating $88 million and a January 2025 case involving two North Koreans and three facilitators for earning $866,255.
What You Should Know
- US authorities arrested Zhenxing Wang and indicted six Chinese and two Taiwanese nationals on June 30, 2025, for aiding North Korean IT workers in a scheme targeting over 100 US companies.
- The scheme generated over $5 million, using stolen identities of over 80 Americans to secure remote IT jobs, with some operatives stealing military technology and cryptocurrency.
- The Justice Department searched 29 laptop farms, seized 137 laptops, 29 financial accounts, and 21 websites as part of a nationwide crackdown.
- China opposed the US actions, rejecting unilateral sanctions and pledging to safeguard its citizens’ rights.
- The operation reflects ongoing US efforts to disrupt North Korea’s cyber-enabled sanctions evasion, with prior indictments in 2024 targeting similar schemes.
