Department of Justice Disrupts North Korean IT Worker Fraud Scheme with Arrest of Nashville Resident
The U.S. Department of Justice announced on Thursday charges against Matthew Isaac Knoot, a 38-year-old Nashville resident, for his alleged role in a scheme to generate illicit revenue for the Democratic People’s Republic of Korea’s (DPRK) weapons program.
According to the indictment, Knut played a central role in orchestrating a fraud scheme that enabled North Korean IT workers to obtain remote employment with U.S. and British companies under false pretenses. The foreign workers, masquerading as U.S. citizens using stolen identities, were facilitated by Knut, who provided them with the necessary technological infrastructure to carry out their work undetected.
Knut’s operation involved setting up a “laptop farm” at his residences in Nashville, where he hosted company-provided laptops that were shipped to him under the name of a fictitious U.S. citizen, “Andrew M.”. Without authorization, Knut installed remote desktop software on these laptops, granting North Korean actors access to the devices from locations in China. This deception allowed the workers to appear as though they were based in the U.S., while in reality, they were contributing to North Korea’s WMD programs.
The scheme proved to be highly lucrative, with the North Korean IT workers earning over $250,000 each between July 2022 and August 2023. Much of this income was falsely reported to U.S. tax authorities under the stolen identity of “Andrew M.”, further compounding the fraudulent activity. The victim companies, which included major players in the media, technology, and financial sectors, suffered significant financial damages, amounting to over $500,000 in auditing and remediation costs.
Knut’s involvement extended beyond facilitating the remote work; he also conspired to launder the illicit proceeds. Payments from the victim companies were funneled through a complex network of financial transactions involving accounts tied to North Korean and Chinese actors. Knut received regular payments for his services from a foreign facilitator operating under the alias “Yang Di.”
Knut has been charged with fraud, computer damage, identity theft, and illegal employment of foreigners. If convicted, Knut faces up to 20 years in prison.
