Two Americans Sentenced For Running ‘Laptop Farms’ That Helped North Korea Infiltrate Nearly 70 U.S. Companies
Two Americans Sentenced For Running ‘Laptop Farms’ That Helped North Korea Infiltrate Nearly 70 U.S. Companies
The U.S. Department of Justice announced the convictions on Wednesday, describing the cases as part of an ongoing crackdown on “laptop farmers”, individuals in the United States who help North Korean operatives pose as legitimate remote workers to secure jobs with American firms.
Two United States nationals, Matthew Issac Knoot of Tennessee and Erick Ntekereze Prince of New York, have been sentenced to 18 months imprisonment each for helping North Korean information technology workers infiltrate American companies through fraudulent remote employment schemes that generated over $1.2million for the Democratic People’s Republic of Korea (DPRK).
The U.S. Department of Justice announced the convictions on Wednesday, describing the cases as part of an ongoing crackdown on “laptop farmers”, individuals in the United States who help North Korean operatives pose as legitimate remote workers to secure jobs with American firms.
According to the Justice Department, the two men received and hosted laptops sent by victim U.S. companies, which believed the workers were based at the defendants’ addresses in the United States.
Authorities said the defendants installed remote desktop applications on the computers, enabling North Korean operatives working overseas to access company systems while appearing to work from within the U.S.
The department said the schemes affected nearly 70 U.S. companies and represented the seventh and eighth convictions secured within the last five months under a broader federal initiative targeting North Korea’s illicit revenue generation operations.
“These sentences hold accountable U.S nationals who enabled North Korea’s illicit efforts to infiltrate U.S. networks and profit on the back of U.S. companies,” said Assistant Attorney General for National Security John A. Eisenberg.
“These defendants helped North Korean ‘IT workers’ masquerade as legitimate employees, compromising U.S. corporate networks and helping generate revenue for a heavily sanctioned and rogue regime.”
Eisenberg added that the National Security Division would continue pursuing individuals who use “deception and cyber-enabled fraud” to threaten U.S. national security.
U.S. Attorney Braden H. Boucek for the Middle District of Tennessee said the cases showed how foreign-based cyber schemes could target American businesses.
“These kind of foreign-based attacks on American businesses will not be tolerated, and those involved will be held accountable for their actions,” Boucek said.
Meanwhile, U.S. Attorney Jason A. Reding Quiñones for the Southern District of Florida described the crimes as deliberate acts aiding “one of the world’s most dangerous adversaries.”
“These were not paperwork violations,” Quiñones said. “They were deliberate acts that exposed U.S. businesses, compromised trust, and supported one of the world’s most dangerous adversaries.”
According to court documents, Prince used his company, Taggcar Inc., to supply supposedly “certified” IT workers to U.S. companies between June 2020 and August 2024, despite knowing the workers were operating outside the United States using stolen or fake identities.
He allegedly hosted company-issued laptops at residences in New York and installed remote-access software without authorization so North Korean workers could secretly operate the devices from abroad.
On Wednesday, U.S. District Judge Darrin P. Gayles sentenced Prince to 18 months in prison followed by three years of supervised release.
He was also ordered to forfeit $89,000 received from the scheme.
Federal prosecutors said Prince and his co-conspirators secured jobs for North Korean workers at more than 64 U.S. companies, generating over $943,000 in salary payments, most of which was transferred overseas.
The Justice Department said the scheme also caused victim companies more than $1million in remediation and cybersecurity audit costs.
Prince was indicted in January 2025 alongside U.S. national Emanuel Ashtor, Mexican national Pedro Ernesto Alonso de los Reyes, and North Korean nationals Jin Sung-il and Pak Jin-Song.
While Ashtor is awaiting trial, de los Reyes remains in custody in the Netherlands pending extradition. The two North Korean suspects are fugitives.
Separately, Matthew Issac Knoot was sentenced on May 1 by U.S. District Judge Eli Richardson in Tennessee to 18 months imprisonment and one year of supervised release.
Knoot was also ordered to pay $15,100 restitution and forfeit another $15,100 earned from the operation.
Court documents revealed that Knoot operated a “laptop farm” from his Nashville residences between July 2022 and August 2023.
Victim companies reportedly shipped laptops to his home, addressed to an individual identified as “Andrew M.”
After receiving the devices, Knoot allegedly installed unauthorised remote desktop software that allowed a North Korean operative in China to remotely access the systems while appearing to work from Tennessee.
Authorities said the operation secured employment from at least four U.S. companies and generated more than $250,000 in payments.
The Justice Department stated that much of the income was falsely reported to the Internal Revenue Service and Social Security Administration under the stolen identity of the real “Andrew M.”
The scheme allegedly caused more than $500,000 in cybersecurity remediation costs to victim companies.
Federal investigators also accused Knoot of lying to the FBI and destroying evidence after agents searched his home in August 2023.
The FBI’s Cyber Division warned that Americans helping North Korean IT workers could face severe criminal penalties.
“The FBI and our partners will continue to disrupt North Korea’s ability to circumvent sanctions and fund its totalitarian regime,” said FBI Cyber Division Assistant Director Brett Leatherman.
“These cases should leave no doubt that Americans who choose to facilitate these schemes will be identified and held accountable.”
The Justice Department said the convictions were secured under the “DPRK RevGen: Domestic Enabler Initiative,” a joint operation involving the National Security Division and the FBI aimed at disrupting North Korea’s illicit cyber revenue networks.
The department also cited previous advisories warning that North Korean IT workers have engaged in data theft, extortion, and sanctions evasion while posing as remote workers using stolen identities and proxy systems.
According to a 2022 advisory by U.S. agencies, individual North Korean IT workers can earn up to $300,000 annually, generating hundreds of millions of dollars each year for entities linked to the country’s weapons programmes.
The U.S. Department of State has also offered rewards of up to $5 million for information helping disrupt North Korea’s cybercrime and illicit financial activities.
