How North Korea turned foreign payroll into revenue for its overseas IT companies—and built a business around the institutions of legitimate employment.
Incident Analysis · North Korea · IT Workers · Employment Fraud · State Enterprises · Financial Networks · Sanctions
Analysis based on publicly available information as of October 15, 2026.
Abstract
On October 13, 2026, the U.S. Department of Justice announced coordinated actions against North Korean remote IT worker operations. A newly unsealed indictment charged 14 individuals in a scheme involving more than 70 American companies and approximately $3 million in revenue. In a separate operation, federal investigators searched more than 40 suspected laptop-hosting locations in Texas and seized approximately 187 computers and related devices. [1][2][3]
The alleged scheme allowed North Korean IT workers to obtain employment under false identities, while intermediaries in the United States maintained company-issued computers and handled payments. American employers provided salaries, equipment, and access to corporate systems to people they believed they had hired. In many cases, the actual workers were operating from another country, and their compensation was collected through accounts controlled by other participants.
The investigation exposes a business structure that extends beyond fraudulent recruitment. Earlier U.S. indictments, Treasury sanctions, and reports from the Multilateral Sanctions Monitoring Team (MSMT) identify North Korean-controlled IT companies operating in China, Russia, and Laos. These organizations have executives, overseas offices, development teams, supervisors, revenue targets, and arrangements for collecting and distributing earnings. Some belong to identifiable state institutions, including organizations associated with North Korea’s military and weapons programs.
The financial relationship is particularly important. For the American company, the payment is an ordinary salary or contractor expense. For the organization managing the actual worker, the same payment may become business revenue, subject to deductions, commissions, and remittances to a parent organization in North Korea. The individual performing the work does not necessarily receive, or control, the amount recorded as compensation by the foreign employer.
This investigation reconstructs the employment and financial relationships connecting American companies, overseas IT businesses, local intermediaries, and North Korean state institutions. It examines how these organizations acquire work, manage employees, collect wages, and move proceeds across borders, while distinguishing the transactions established in the October 2026 indictment from the corporate structures documented in earlier investigations.
The central problem is not simply that recruitment procedures can be deceived. An employment contract establishes a legitimate basis for granting access to company systems and paying compensation, but the legal identity recognized by the employer may differ from the person performing the work and the organization controlling its proceeds. North Korea’s IT labor operations have developed a business around that separation.
1. Incident Overview
The October 13 Justice Department announcement brought together two investigations targeting different parts of the North Korean IT worker economy.
The first concerned an indictment returned on October 1 in the Northern District of Ohio. Prosecutors charged 14 individuals, including China-based organizers and American facilitators, with participating in a scheme to obtain remote employment at U.S. companies through stolen and fabricated identities. The Justice Department reported that the operation affected more than 70 employers across multiple industries and generated approximately $3 million in revenue. The department assessed that proceeds were believed to have been sent to sanctioned entities controlled by North Korea. [1][2]
The second investigation, Operation Lonestar Roundup, targeted the physical infrastructure supporting these employment arrangements. During September 21–25, federal agents searched more than 40 residences in Texas and seized approximately 187 laptops and keyboard-video-mouse devices. These locations allegedly allowed workers abroad to operate company-issued computers physically located in the United States, making their activities appear consistent with domestic remote employment. [3]
The two operations were coordinated, but the seized computers and the Ohio indictment do not represent a single established set of victims, participants, or financial transactions. The indictment provides detailed evidence about a particular alleged conspiracy, while the Texas operation demonstrates the wider infrastructure used by North Korean IT workers.
The Ohio case describes a division of responsibilities among several groups. North Korean workers allegedly obtained jobs using false identities, while China-based participants coordinated workers, managed accounts, and arranged payments. American collaborators received corporate laptops, maintained remote-access environments, participated in employment-related activities, and transferred money through banking and payment services.
One American collaborator, Trey Michael Nolte, appears extensively in the indictment as an uncharged participant. Prosecutors allege that Nolte recruited and managed other domestic facilitators, received company-issued devices, and controlled accounts through which fraudulent payroll proceeds moved. His company, Dark Falls LLC, received salary payments associated with a fictitious employee. Another participant, Jin Long, allegedly established B SUCCEED LLC in Texas to support fabricated employment histories. [2]
These companies performed different functions within the alleged operation. One helped explain why corporate laptops were being received and maintained at an American address, while the other supplied an apparently independent source of professional credentials. Neither arrangement required the direct compromise of an employer’s recruitment platform or identity-management software.
The October 13 FBI advisory describes how this broader intermediary market has expanded. North Korean IT worker teams increasingly pay Americans to provide established professional identities, attend interviews, maintain computers, and assist with employment-related verification. Some groups also subcontract work to freelancers in South Asia and West Africa, retaining the employment contract while purchasing software development or other services from third parties at a fraction of the compensation received. [8]
The resulting organization resembles a distributed staffing and outsourcing business. Its participants can specialize in recruitment, identity provision, computing infrastructure, software development, or payments without necessarily participating in every part of the operation.
The October indictment establishes important portions of this network, but it does not publicly identify the specific North Korean employer or parent organization responsible for every worker. Understanding the business behind the alleged fraud therefore requires examining earlier investigations in which the overseas companies themselves were identified.
2. How the Employment Scheme Worked
The alleged activity was conducted over several years rather than through a single intrusion. The Justice Department describes fraudulent employment activity beginning in 2019 and continuing into approximately July 2025, while the indictment includes a broader alleged conspiracy period extending into January 2026 and financial transactions recorded through early February 2026.
2.1 Dated chronology
| Period or date | Reported event | Evidentiary scope |
|---|---|---|
| 2019–approximately July 2025 | Workers obtained remote positions at U.S. companies through false identities. | Employment period described by the Justice Department for the Ohio case [1][2] |
| September–November 2024 | Payroll for a fictitious employee entered Dark Falls LLC’s bank account and most of it moved to a Nolte-controlled payment account. | Transactions alleged in the Ohio indictment [2] |
| February 2025–early February 2026 | A Pena-controlled account received payroll from five victim employers and transferred part of it for overseas co-conspirators. | Transactions alleged in the Ohio indictment [2] |
| September 21–25, 2026 | Federal agents searched more than 40 suspected laptop-hosting residences in Texas. | Separate Texas operation [1][3] |
| October 1, 2026 | The Ohio indictment was returned. | Criminal allegations, not trial findings [2] |
| October 13, 2026 | The Justice Department announced the Ohio charges and Texas operation together. | Coordinated announcement, not proof of one common victim or financial chain [1][3] |
The transaction periods overlap the broader alleged employment activity. The Texas searches belong to a separate investigation; their place in this chronology does not join their devices or victims to the Ohio accounts.
2.2 Operational sequence
The following table describes the alleged operating pattern, not a dated sequence for every employer. It begins with the creation of an apparently legitimate employee and ends with compensation leaving the accounts through which the employer originally paid it.
| Stage | Activity | Authority or asset obtained |
|---|---|---|
| Identity preparation | Stolen or fabricated personal information, professional profiles, and employment histories are assembled. | A plausible identity that can enter the recruitment process |
| Recruitment | Applications, interviews, and employment verification are conducted under the assumed identity, sometimes with paid assistance. | An offer of employment or a contractor relationship |
| Corporate onboarding | The employer issues accounts, credentials, and company equipment. | Authorized access to internal systems and business data |
| Remote operation | A domestic facilitator hosts company devices while the actual worker accesses them from abroad. | Continued use of the employee’s authorized working environment |
| Payroll collection | Compensation is paid to an account associated with the apparent employee or an intermediary. | Revenue from the foreign employer |
| Financial transfer | Funds move through domestic accounts, payment services, and overseas recipients. | Control of the proceeds by participants outside the employer’s organization |
This is a reconstruction of the operational sequence described across the indictment, not a claim that every employer experienced every stage in exactly the same way.
2.3 Constructing an employee
The earliest stage involved establishing an identity credible enough to obtain employment. The indictment describes stolen or fabricated identification information, professional credentials, and employment histories. Some participants arranged for another person to appear in interviews or provide assistance with questions, allowing the person presented to the employer to differ from the individual who would actually perform the work.
The use of B SUCCEED LLC illustrates how the process extended beyond individual identity documents. By creating a company that could purportedly verify prior employment, the participants could provide evidence from an apparently separate organization. The employer’s reference check could therefore encounter a real corporate entity without establishing whether the claimed employment relationship was genuine.
Once the hiring process was completed, the employer issued the credentials and equipment necessary for ordinary work. The critical transition occurred when the identity accepted by human resources became the basis for access granted by IT and security systems. The employer no longer needed to be deceived at every individual login; it had already created an authorized working relationship.
2.4 Separating the corporate device from the actual worker
Company-issued laptops were shipped to addresses controlled by American facilitators, who kept them connected and made remote access possible for workers elsewhere. The FBI describes this infrastructure as laptop farms, although the term can cover anything from multiple devices in one residence to a distributed collection of smaller hosting locations.
The October 2026 advisory reports a shift toward a larger number of sites containing fewer computers. Such arrangements reduce reliance on any single facility and make it possible to replace a facilitator without necessarily abandoning the employment relationship. [8]
A company could consequently observe an authorized device operating from an expected location while remaining unaware that the person controlling the work was abroad. Network location, device ownership, employment identity, and actual human control were separate properties, but the normal onboarding process could treat them as evidence of a single legitimate employee.
This separation also had a commercial advantage. The worker did not need to be physically located near the employer, and the organization managing the worker could continue operating from an overseas development office or another location with access to international contracting and payment infrastructure.
2.5 Turning employment into a payment channel
The final stage moved compensation from the employer’s payroll into accounts controlled by intermediaries and overseas participants.
In the Ohio case, prosecutors identified transfers involving Nolte-controlled accounts, Dark Falls LLC, and accounts belonging to other alleged participants. The indictment describes payments originating with American employers and subsequently moving through domestic banks and money-transfer services to recipients outside the United States, including accounts in China. [2]
By the time those payments reached the intermediary accounts, their original purpose had already been established by the employer as legitimate compensation. The receiving bank or payment service was processing financial transactions whose wider context depended on employment and technical arrangements outside its direct view.
The reported operation was disrupted in September and October 2026, but these actions targeted identifiable participants and infrastructure rather than the corporate structure of North Korean overseas IT businesses as a whole. That structure had already been documented in earlier sanctions and criminal investigations.
3. The Companies Behind the Workers
3.1 Silverstar: an overseas company with executives, managers, and employees
On September 13, 2018, the U.S. Treasury sanctioned Yanbian Silverstar Network Technology Co., Ltd., based in China’s Jilin Province, and its sister company Volasys Silver Star, based in Vladivostok, Russia.
Treasury described Yanbian Silverstar as nominally Chinese but actually managed and controlled by North Koreans. The Russian company had been established in early 2017 by a North Korean IT worker associated with the Chinese organization, and employees subsequently moved between the two locations. By the time of the sanctions announcement, both companies had generated substantial revenue through international IT work. [5]
The internal management system became more visible in December 2024, when American prosecutors indicted 14 North Korean nationals associated with the two Silverstar companies. The indictment alleged that the organizations collectively employed or retained at least 130 North Korean IT workers and generated at least $88 million over approximately six years, from 2017 to 2023. This was a separate case from the 14-person indictment announced in October 2026. [4]
The 2024 indictment identifies Jong Song Hwa as the Mission Representative responsible for both companies. Kim Ryu Song served as president of Yanbian Silverstar, while Ri Kyong Sik served as president of Volasys Silverstar. Beneath these executives were delegation leaders responsible for daily operations, group leaders supervising smaller development teams, and programmers performing the actual work.
This was a recognizable management hierarchy, not simply an informal network of freelancers. Executives established business targets, supervised personnel, determined promotions, reassigned workers, and organized performance competitions. According to prosecutors, Jong expected each IT worker to generate at least $10,000 per month for North Korea, while management rewarded high-performing workers with bonuses and other prizes.
The organization also maintained a relationship with the North Korean state. The MSMT’s October 2025 report identifies the Silverstar companies as part of a group of IT worker enterprises operated by the 313 General Bureau, itself subordinate to the Munitions Industry Department of the Workers’ Party of Korea. [6]
The documented organizational relationship is therefore:
Munitions Industry Department → 313 General Bureau → Silverstar companies → delegation leaders and development teams → IT workers.
This hierarchy matters economically because the foreign employer was not necessarily purchasing labor from an independent individual. It could be paying someone whose work, performance, and earnings were managed by a separate organization. The American employment relationship provided access to the customer and its payroll, while Silverstar provided the workforce and exercised managerial control.
The indictment also alleges that managers instructed workers to send salary and extortion proceeds to accounts controlled by North Korean interests, including accounts at Chinese banks. The proceeds could therefore move from an employer’s payroll into the financial accounts of the organization that managed the worker.
3.2 Kyonghung: a development company operating from a Chinese factory
Silverstar was not the only example of an overseas IT business linked to a North Korean state institution.
The MSMT’s 2025 report identifies Kyonghung Information Technology Exchange Company as a subsidiary of Kyonghung Trading Bureau, an organization affiliated with Office 39 of the Workers’ Party of Korea. Office 39 is responsible for activities that generate and manage foreign currency for North Korean leadership.
Kyonghung IT was headquartered in Dandong, China, and consisted of 15 people, including director Kim Kwang Myong and several development teams. The workers lived together in the dormitory of a garment factory operated by Liaoning Golden Phoenix Garment Co., Ltd. in Fengcheng, Dandong. [6]
This arrangement provides an unusually concrete view of the physical business. The developers were not merely accounts appearing on freelance websites; they were an identifiable workforce occupying facilities belonging to a local commercial enterprise. The published record establishes that hosting relationship, although it does not independently establish that every party involved in operating the garment factory knew the workers’ actual affiliations or payment arrangements.
Kyonghung’s teams developed gambling websites, including customer-account functions, settlement-related applications, web interfaces, and maintenance services. They sought clients through online freelance platforms while concealing their North Korean identities, often presenting themselves as developers from other countries.
MSMT documented a typical development price of approximately $5,000 per gambling website, with monthly maintenance charges ranging from $2,000 to $5,000. A significant portion of the company’s revenue was remitted every month to its parent organization, Kyonghung Trading Bureau, in North Korea.
Unlike a case in which the final destination of an individual salary transfer remains unknown, the Kyonghung example identifies an operating company, its parent organization, its commercial services, and a recurring remittance relationship. The report does not provide a complete profit-and-loss account, but it establishes that the overseas company generated customer revenue and transferred part of that revenue to a North Korean parent.
The case also demonstrates why formal branch registration is not the only relevant evidence of an overseas business. A company can maintain a functional development office through accommodation, local relationships, freelance accounts, and foreign payment services without all those activities being conducted through one registered corporate address.
3.3 Military-associated enterprises and labor contracts
A third model appears in the U.S. Treasury’s January 2025 sanctions against Department 53 of North Korea’s Ministry of National Defense and several related enterprises.
Treasury identified Department 53 as a weapons-trading organization that generated revenue through front companies in industries including software development. Korea Osong Shipping Co. had maintained IT worker delegations in Laos since at least 2022, while Chonsurim Trading Corporation directed another group of workers there from at least 2021. These teams used false identities to undertake website development, mobile applications, cryptocurrency-related projects, and other work for international customers. [7]
In these cases, the relationship between a military-associated state institution and commercial software development was explicit. Treasury identified the delegation management and described the resulting revenue as supporting North Korean state and munitions activities.
The MSMT also reported that Korea Kyongru Trading Corporation, a likely Department 53 front company, had a labor-supply contract with Russia’s LLC Renova. The contract covered 25 IT workers for a ten-year term beginning in early 2025. It specified an average monthly salary of at least $1,200, an overtime and holiday rate of $4 per hour, and provisions for Renova to establish Russian bank accounts for the workers. The report establishes the contract’s terms, not how fully the arrangement was carried out or what each worker received. [6]
This contract is particularly useful because it shows that overseas IT labor could be organized through explicit wage and labor-supply terms, rather than only through fictitious direct employment. It establishes the stated compensation and banking arrangements, although it does not demonstrate that each worker actually received or freely controlled the contractual amount.
Taken together, Silverstar, Kyonghung, and the Department 53-related enterprises illustrate different organizational forms within a wider state-directed IT labor economy. Some operate through overseas companies, others through delegations or labor-supply agreements, and still others rely more heavily on intermediaries providing services to workers located elsewhere.
These companies should not be treated as a single corporate group. They belong to different reported parent organizations, and the available records do not demonstrate that the China-based managers charged in October 2026 worked for any particular one of them. Their value as comparison cases is that they establish the existence of overseas employers, management hierarchies, and revenue-collection mechanisms that are not visible from the latest indictment alone.
4. Who Receives the Salary?
4.1 The employer’s payroll is not the worker’s final income
The economics of the operation become clearer when the compensation recorded by a foreign employer is distinguished from the revenue collected by an overseas IT company and the wages retained by the person doing the work.
In an ordinary direct-employment relationship, the employer pays a worker who is expected to control their compensation, subject to lawful deductions and other obligations. In the cases documented here, the employment identity, the actual worker, the person managing the worker, and the party collecting the proceeds can be different.
The October 2026 indictment shows the first stages of this process in account-level detail.
According to prosecutors, between September and November 2024, approximately $42,586 in compensation associated with a fictitious employee was deposited into an account held by Nolte’s Dark Falls LLC. Approximately $41,107 then moved from that account to another payment account under Nolte’s control.
A separate Nolte-controlled money-transfer account received approximately $158,676 in deposits from victim-company payroll accounts and transfers from other Nolte-controlled accounts. During the relevant period, Nolte allegedly transferred approximately $132,107 to accounts outside the United States, including approximately $131,897 to accounts located in China and controlled by co-conspirators. [2]
The indictment describes another set of transactions involving Juan Cecilio Pena Carrillo. Between February 2025 and February 2026, an account under his control received approximately $190,510 in fraudulent employee payroll payments from five American companies. Approximately $155,205 was subsequently transferred to another payment service for the benefit of overseas co-conspirators.
| Account or transaction | Amount | Documented relationship |
|---|---|---|
| Dark Falls LLC payroll deposits | $42,585.55 | Compensation received through a U.S. company |
| Transfers out of Dark Falls LLC | $41,106.74 | Movement to a Nolte-controlled account |
| Nolte-controlled MTS-3 receipts | $158,675.54 | Payroll deposits and transfers from other controlled accounts |
| Nolte’s subsequent overseas transfers | $132,107.42 | Payments to foreign accounts, predominantly in China |
| Pena-controlled MTS-3 receipts | $190,510.39 | Compensation paid by five victim employers |
| Pena’s transfers to MTS-4 | $155,204.80 | Funds moved for the benefit of overseas co-conspirators |
Source: October 2026 indictment, paragraphs 363–372. [2]
These transactions cannot be summed as independent revenue because some entries represent subsequent transfers of funds already received through other accounts. Their significance lies in the documented movement of employer compensation into accounts controlled by people outside the nominal employment relationship.
The indictment establishes substantial transfers from American payroll into an international network. It does not provide the complete distribution of those proceeds among actual developers, local facilitators, overseas managers, North Korean enterprises, and state institutions.
That distinction matters because the organizational income of a state-linked IT business cannot be calculated by simply assuming that every dollar transferred to China reached the North Korean government.
4.2 Overseas companies have their own salary administrators
The MSMT report provides another important detail: overseas organizations were not only collecting money from customers but also administering wages and payments associated with their workforces.
One example is Kim Sang Man, the representative of Chinyong Information Technology Cooperation Company’s office in Vladivostok. According to the MSMT, Kim was involved in salary payments for North Korean IT workers associated with operations in Vladivostok, Shenyang, and Dubai. The U.S. Treasury had previously described his presumed involvement in payments to family members of overseas workers. [6][9]
Kim was also involved in financial transfers connected to the company’s activities. Treasury reported that he received more than $2 million in cryptocurrency transfers from IT teams in China and Russia, while MSMT described his involvement in laundering cryptocurrency proceeds raised by North Korean IT workers.
The precise relationship between those cryptocurrency receipts, individual salary liabilities, and payments to workers’ families is not fully documented in public records. Nevertheless, the evidence identifies a financial administrator within a North Korean overseas IT organization whose functions included both managing revenue and participating in wage-related payments.
This complicates the simple picture of an employer paying a worker who then forwards most of the money to the state. In at least some organizations, the overseas company itself appears to participate in administering the compensation system, potentially including payments made on behalf of workers to family members.
The distinction between contractual wages and actual economic control is therefore fundamental. A payment may be nominally associated with a worker while its disbursement, transfer, or eventual use is managed by someone else.
4.3 Revenue targets and the state’s share
The available evidence also shows that overseas IT businesses were operated according to explicit revenue objectives.
The Silverstar indictment describes a target of at least $10,000 per worker per month. MSMT reports similar targets across other IT teams, with some managers requiring substantially greater earnings from high-performing workers. These amounts refer to revenue generation, not necessarily to salaries paid to developers.
According to the MSMT’s October 2025 report, North Korean IT workers may be required to remit half their income to affiliated organizations, with additional deductions or payments to government bodies, supervisors, partners, and other intermediaries. The report describes cases in which the workers retained only 5–10% of their gross income. It estimated North Korea’s total earnings from IT workers worldwide at approximately $350 million to $800 million in 2024. [6]
The U.S. Treasury has separately stated that the North Korean government may withhold up to 90% of earnings generated by overseas IT workers. These figures are estimates or observations concerning the wider industry, not a uniform compensation schedule established for every overseas company. [7]
Consequently, the $10,000 Silverstar revenue target, the $1,200 Renova contractual salary, and the reported 5–10% retained-income cases cannot be combined to calculate the wages of a particular employee. They describe different organizations and different accounting concepts.
What they collectively establish is a business structure in which the revenue generated by an individual worker can be substantially greater than the compensation that worker retains, with part of the difference allocated to the organization controlling the workforce.
The economic relationship is therefore more complex than salary theft alone. It includes the costs of obtaining work, managing employees, securing identities, operating overseas facilities, paying intermediaries, moving funds, and remitting earnings to parent institutions.
4.4 The emergence of a market for employment infrastructure
A further consequence of this model is that the organization does not need to perform every supporting activity internally.
MSMT documented brokers selling verified professional identities, freelance accounts, payment-platform access, and related services, sometimes packaged with computers and local internet infrastructure. The FBI’s October 2026 advisory describes American facilitators being recruited for similar purposes and notes that some North Korean teams now subcontract entire assignments to third-country freelancers. [6][8]
The commercial relationship can therefore be divided among several providers. One supplies a credible identity, another participates in recruitment, another maintains a computer, a freelancer performs some or all of the contracted work, and a financial intermediary receives or transfers compensation.
These suppliers do not necessarily have the same knowledge or intentions. Some may knowingly facilitate fraudulent employment, while others may provide ordinary services without understanding the real identity or affiliation of the customer. Neither their participation in a transaction nor their appearance in an investigative report establishes criminal responsibility by itself.
For the North Korean-controlled organization, however, external services can reduce the cost of maintaining a permanent presence in the customer’s country. The enterprise can concentrate on obtaining employment, allocating work, supervising revenue, and collecting proceeds while purchasing supporting functions as required.
This is one reason disruption of individual laptop-hosting locations is unlikely, by itself, to eliminate the economic incentive behind the wider industry.
5. The Institutions Behind the Employment Contract
The Ohio allegations show how employment decisions could yield both corporate access and a payroll stream. Earlier investigations reveal several forms of overseas organization that could manage workers and collect revenue, but do not identify the specific North Korean company behind the Ohio workers. The figure keeps those evidence groups separate.
5.1 Employment converts an identity into organizational authority
The operation depended on more than persuading an employer that a particular individual was qualified for a job. The recruitment process also initiated a series of institutional decisions that allowed the purported employee to act on the employer’s behalf.
Human resources evaluated the applicant and processed employment documentation. IT issued company equipment and credentials. Security systems authenticated the resulting accounts and devices, while payroll recorded compensation owed to the recognized employee. Each function relied in part on the employment relationship established by the preceding process.
The Ohio indictment illustrates what happens when the person accepted during recruitment is not necessarily the person who subsequently performs the work. The employer can issue valid credentials to an account created through a fraudulent identity and then observe those credentials being used in technically authorized ways.
The relevant access does not require exploitation of a software vulnerability. The employer has granted it as a consequence of an apparently legitimate employment decision.
This also explains why employment fraud in this context creates a cybersecurity problem. The employee account can provide access to source-code repositories, development infrastructure, internal communications, proprietary information, and business systems. The North Korean-controlled organization may therefore receive both a stream of compensation and practical access to corporate resources through the same contractual relationship.
5.2 Corporate registration establishes existence, not independence
The role of B SUCCEED LLC in the October indictment demonstrates a related problem in the use of corporate records for employment verification.
A company may exist as a registered legal entity without being an independent source of information about an applicant. If the company was created or controlled by participants in a fraudulent employment operation, its confirmation of a previous employment history cannot be treated as independent merely because it comes from a separate corporate name.
The Silverstar case offers an earlier version of the same arrangement. Prosecutors described websites and domains established to make fabricated companies appear to be credible former employers, supporting the invented work histories of applicants. [4]
The institutional issue is the difference between verifying the existence of a company and establishing the authenticity of its underlying business relationships. A company registration may answer the first question while providing little evidence about the second.
The distinction is especially relevant to international contracting, where employers routinely encounter unfamiliar companies, contractors, references, and intermediaries. The legal identity of a contracting organization does not automatically establish who owns it, who manages the work, or whether the personnel it supplies are the people represented in the transaction.
5.3 Financial institutions see a different part of the transaction
The October indictment includes a particularly revealing account of the banking relationship maintained by Dark Falls LLC.
When establishing the company’s bank account, Nolte described the business as a remote service provider that received laptops from customers and kept them connected and operational. Prosecutors included that explanation among the representations made for the bank’s Know Your Customer requirements. [2]
The description was not entirely detached from the activity alleged in the indictment. The operation did involve receiving and maintaining computers. What the description omitted was the relationship between those computers, the individuals who supposedly owned the employment accounts, the workers operating the devices from abroad, and the destination of the resulting payroll.
A financial institution assessing the stated business activities of a computer-hosting service does not necessarily possess the employer’s recruitment records or know who uses each machine. The employer, meanwhile, generally does not supervise the subsequent international transfers made from every account into which it pays wages.
Existing customer-due-diligence, anti-money-laundering, and sanctions requirements impose obligations on financial institutions, and their application depends on the relevant facts and jurisdiction. The problem here is not that these institutions have no responsibilities. It is that determining the actual relationship among worker, employer, intermediary, and beneficiary may require information distributed across multiple organizations.
The financial transaction has a legitimate origin in the employer’s accounting system even when the underlying employment was obtained fraudulently. Once the compensation passes through intermediary accounts, the financial institution may be examining a transaction whose economic purpose cannot be understood solely from the identity of the account holder.
5.4 Sanctions regulate a relationship that crosses several jurisdictions
North Korean overseas labor has long been subject to international restrictions. United Nations Security Council Resolution 2375 restricted new work authorizations for North Korean nationals, while Resolution 2397 required member states, subject to applicable national and international law, to repatriate North Korean nationals earning income abroad by the end of 2019. [6]
The overseas IT industry complicates enforcement because the location of the actual worker, the apparent employee, the contracting company, the computer, and the payment recipient can all differ.
A North Korean developer might work from an office in China or Russia, or from within North Korea itself. The customer might be an American company paying an apparently domestic employee. The company managing the worker might belong to a North Korean state institution, while the payroll is first received through a local facilitator’s account.
The physical presence of a North Korean laborer is only one part of this arrangement. Workers operating from inside North Korea can still obtain foreign contracts, and overseas personnel can provide identity, banking, and customer-facing functions without necessarily performing the development themselves.
These arrangements do not make the transactions exempt from sanctions or employment law. Rather, they create additional problems of identification, attribution, and enforcement, especially where the effective control of labor and its economic proceeds are concealed behind third-party identities and corporate entities.
The MSMT reports make clear that several North Korean state institutions maintain overseas IT operations or benefit from their proceeds. The Munitions Industry Department, Ministry of National Defense, Office 39, and other organizations have distinct corporate and administrative relationships. Their activities cannot be collapsed into a single command structure simply because they pursue similar revenue-generating objectives.
The state-directed business is therefore international not only because its customers are overseas, but because its labor, ownership, management, and payment relationships span multiple legal systems.
5.5 Who is responsible for identifying the actual employer?
These cases expose a question that ordinary employment, corporate, and financial verification do not always answer in the same way: who actually controls the labor being purchased?
Human resources checks an applicant’s identity, qualifications, and claimed employment history. IT and security systems verify an issued account and device against access rules. A bank checks its account holder, stated business activity, and transactions. Sanctions authorities examine whether a regulated person or entity controls the work or benefits from its proceeds. Each institution sees different records and answers a different question. A valid account, registered company, or completed payroll entry cannot alone establish that the person doing the work is the person the customer agreed to hire.
The legal employer, the customer’s contractual counterparty, the organization directing daily work, and the ultimate economic beneficiary can differ in legitimate outsourcing arrangements. Their separation is not itself evidence of fraud. In the alleged Ohio scheme, the critical difference was that false identities and employment histories concealed who would perform and control the work. The customer then granted access and paid compensation on a representation that did not describe that relationship.
The precise North Korean company behind the Ohio workers and the final division of their earnings remain unknown. That limit does not erase the institutional failure the case illustrates: the employer, device host, and financial intermediaries could each record a locally coherent part of the arrangement while the represented employment relationship as a whole was false.
6. Conclusion — Who Actually Employs the Worker?
The October 2026 enforcement actions exposed the American-facing infrastructure of North Korean remote IT worker operations: fabricated identities, corporate laptops, domestic facilitators, and accounts used to collect and transfer payroll. Earlier investigations reveal what can exist behind that infrastructure.
Silverstar operated through companies in China and Russia with identifiable executives, management hierarchies, revenue quotas, and performance incentives. Kyonghung maintained a development organization in Dandong that sold commercial software services and remitted revenue to a parent institution in North Korea. Department 53-related companies used overseas delegations and contractual arrangements to generate revenue through software development, while Chinyong’s operations included financial administrators involved in salary-related payments and international transfers.
These are separate documented organizations, not an established single network. The precise North Korean corporate affiliation of the China-based managers named in the October 2026 Ohio indictment remains publicly unresolved, and its account records do not establish how much of every payment was ultimately received by individual workers or state institutions. The indictment’s allegations also remain subject to criminal proceedings.
Nevertheless, the organizational and economic structure is evident across the records. North Korean state-linked enterprises can obtain access to international labor markets by presenting their workers as independent developers or employees of foreign companies. Those workers may be managed through overseas businesses with their own supervisors, revenue requirements, and financial arrangements, while local intermediaries provide the identities, devices, and payment channels necessary to maintain the customer relationship.
The foreign employer records the payment as compensation for its own employee or contractor. The overseas organization may treat the same compensation as revenue generated by its workforce, allocate part of it to intermediaries and workers, and transfer the remainder through corporate or state-linked financial channels. In documented cases, the person performing the labor retains only a fraction of the amount earned under the external contract.
The result is a distinctive form of international economic activity. North Korea can participate in foreign software markets through ordinary-looking employment and outsourcing arrangements even when its direct access to those markets is constrained by sanctions. The organization controlling the labor does not need to appear as the customer’s contractual counterparty, and the customer does not necessarily recognize that its payroll expenditure is supporting a foreign state-linked enterprise.
This is also why the security implications cannot be separated from the economic structure. The employment contract is the basis on which the foreign company issues credentials, grants access to internal systems, provides equipment, and pays compensation. Once that contractual relationship has been accepted, the organization controlling the worker can benefit from privileges that the employer intended to give to someone else.
The underlying problem is therefore not simply inadequate identity verification or the existence of fraudulent job applicants. It is that the identity of the employee, the person controlling the work, and the organization receiving its economic proceeds may be established by different institutions, using different records, without those relationships being reconciled.
The October investigation demonstrates how that separation can be exploited against individual companies. The history of North Korea’s overseas IT enterprises shows how the same separation can support a much larger international business, organized through companies, managers, labor contracts, and financial intermediaries.
Understanding the operation requires following both the authority conferred by employment and the money produced by that employment. Together, they reveal how an apparently ordinary salary can simultaneously finance a foreign enterprise and provide its workforce with legitimate access to another company’s systems.
References
U.S. Criminal Proceedings and October 2026 Investigation
[1] U.S. Department of Justice. “Justice Department Announces Coordinated Actions to Combat North Korean Remote IT Worker Schemes Affecting More than 70 U.S. Companies.” October 13, 2026.
[2] United States v. Sun Sheng Ming et al. Indictment, Northern District of Ohio, filed October 1, 2026. Particularly paragraphs 17–31 and 363–372.
https://www.justice.gov/opa/media/1465576/dl?inline=
[3] U.S. Attorney’s Office, Northern District of Texas. “Operation Lonestar Roundup Dismantles North Korean IT Worker Network Used to Penetrate U.S. Companies in Texas.” October 13, 2026.
Overseas Companies and Corporate Organization
[4] United States v. Jong Song Hwa et al. Indictment, Eastern District of Missouri, filed December 11, 2024. Particularly paragraphs 14–27.
https://www.justice.gov/opa/media/1380081/dl
[5] U.S. Department of the Treasury. “Treasury Targets North Korea-Controlled Information Technology Companies in China and Russia.” September 13, 2018.
https://home.treasury.gov/news/press-releases/sm481
[6] Multilateral Sanctions Monitoring Team. The DPRK’s Violation and Evasion of UN Sanctions through Cyber and Information Technology Worker Activities. October 22, 2025. Particularly pages 20–23, 52–66, 81–90, and Annex 9.
https://www.mofa.go.jp/files/100922718.pdf
[7] U.S. Department of the Treasury. “Treasury Targets IT Worker Network Generating Revenue for DPRK Weapons Programs.” January 16, 2025.
https://home.treasury.gov/news/press-releases/jy2790
Financial Networks and Recruitment Practices
[8] Federal Bureau of Investigation / Internet Crime Complaint Center. “North Korean IT Workers Expanding Use of Facilitators, Broadening Recruitment.” October 13, 2026.
https://www.ic3.gov/PSA/2026/PSA261013
[9] U.S. Department of the Treasury. “Treasury Targets DPRK Malicious Cyber and Illicit IT Worker Activities.” May 23, 2023.
https://home.treasury.gov/news/press-releases/jy1498
Evidentiary Scope
This investigation combines allegations in two separate U.S. criminal cases, U.S. Treasury sanctions designations, FBI reporting, and findings published by the Multilateral Sanctions Monitoring Team. These sources describe multiple organizations operating across different periods and jurisdictions. They should not be read as establishing a single corporate structure or an uninterrupted financial chain connecting all named participants.
The October 2026 indictment documents specific employment-related transactions and transfers, but does not publicly establish the complete distribution of proceeds to individual workers, overseas companies, and North Korean state institutions. The Silverstar, Kyonghung, Chinyong, and Department 53-related cases are used as independently documented examples of the broader industry’s management and financial structures.
Allegations against the defendants in the October 2026 case have not been proven at trial. References to government assessments, reported corporate relationships, and financial activity are attributed to their respective sources; the participation of a third-party business or payment service in a documented transaction does not by itself establish knowledge of or responsibility for illicit conduct.