DPRK RevGen Massachusetts Scheme: Laptop Farms and Shell Companies for North Korean IT Workers

What happened

Kejia "Tony" Wang and Zhenxing "Danny" Wang, two US nationals based in New Jersey, ran a multi-year scheme (roughly 2021 to October 2024) that placed North Korean IT workers into remote jobs at more than 100 US companies by disguising them as ordinary US-based remote employees. The workers used the stolen identities of more than 80 real Americans to get hired, and the two men created shell companies (Hopana Tech LLC, Tony WKJ LLC, Independent Lab LLC) plus "laptop farms" at their residences to host victim-company laptops and route remote access to the overseas workers via KVM hardware. The scheme generated more than $5 million for the DPRK government and caused victim companies at least $3 million in remediation costs; one victim, a California defense contractor, had ITAR-controlled technical data stolen by an overseas co-conspirator in early 2024. Charges were filed in June 2025 and announced as unsealed on June 30, both men pleaded guilty (September 2025 and January 2026), and both were sentenced to federal prison in April 2026. The two men share a surname but no source describes them as related, and none of the conduct charged in either document involves a deepfake, an AI tool or a video interview.

How it worked

From roughly 2021 to October 2024, North Korean IT workers and overseas co-conspirators (in China, the UAE and Taiwan) used stolen and fabricated identities, compromising more than 80 real US persons, to apply for and win remote IT jobs at more than 100 US companies, including many Fortune 500 firms. The identity came first: conspirators registered accounts with two commercial online background-check services and ran public-records searches against more than 700 Americans to verify names, addresses, dates of birth and Social Security numbers before any application was filed. They then forged US driver's licenses, Social Security cards and passports pairing a worker's photograph with a real American's details, built resumes and online profiles to match specific job postings, and, on being hired, signed I-9 employment eligibility forms falsely swearing US citizenship and residency under penalty of perjury.

Kejia Wang served as the US-based manager, traveling to Shenyang and Dandong, China in 2023 to coordinate with overseas actors, including a former classmate he knew was from North Korea, and supervising at least five US facilitators. Zhenxing Wang was one of those facilitators. Once a candidate was hired, the victim company shipped a work laptop to a facilitator's US residence, addressed to the stolen identity; the Information tabulates 117 dated deliveries to one address alone, which is why the conspiracy was charged as mail fraud as well as wire fraud. The facilitators ran laptop farms of hundreds of hosted machines and connected each laptop to KVM (keyboard-video-mouse) switches or remote-desktop software, letting the overseas worker operate it as if physically present in the US. The shell companies, with matching websites and bank accounts, had no real employees or operations and existed solely to receive victim-company wage payments and launder them onward. Separately, between January 19 and April 2, 2024, an overseas co-conspirator used this remote-access setup to reach the network of a California-based defense contractor that develops artificial-intelligence-powered equipment ("Company C" in court filings) and download technical data marked as controlled under the International Traffic in Arms Regulations (ITAR).

The lure and the tell

The lure was a convincing "remote US-based IT professional" package: a real American identity that survived a background check because it was real, forged documents built around it, a plausible resume matched to the posting, a sworn eligibility form, and a corporate laptop that authenticated and behaved as if it were sitting where the employee said he lived. That is what employers expect from a legitimate remote hire, especially post-pandemic when in-person verification norms had relaxed.

The tell that eventually unraveled it was investigative and forensic rather than something the victim companies caught in real time: searches at eight locations across three states recovered more than 70 laptops and remote-access devices such as KVMs, investigators seized 29 financial accounts and 17 web domains used in the scheme (four of them tied directly to the shell companies), and wage payments were traced from the Hopana Tech, Tony WKJ and Independent Lab accounts overseas. Publicly, the wider DPRK IT-worker campaign has been caught via secondary tells, most of them post-hire: Microsoft records work-issued laptops authenticating from known laptop-farm IP addresses or from Chinese or Russian addresses, RMM software downloaded onto a laptop as soon as it is issued and paired with a VPN, use of public VPNs such as Astrill, a persona employed at several companies at once, and workers never or rarely seen on camera who report persistent video or microphone problems. The tell available inside this case, and unused at the time, was simpler still: a laptop for a California-resident employee, shipped to a house in New Jersey.

Outcome

A grand jury in the District of Massachusetts returned a five-count indictment on June 26, 2025 charging Zhenxing Wang on counts one through four, alongside eight overseas co-defendants (six Chinese nationals and two Taiwanese nationals, all still at large as of April 2026 and none of them convicted, so they are not named here). Kejia Wang was charged the next day, June 27, 2025, not by indictment but by criminal Information, having already agreed to plead guilty; he formally waived indictment in open court on September 3, 2025. The Justice Department announced both cases as unsealed on June 30, 2025, and Zhenxing Wang was arrested.

Kejia Wang pleaded guilty on September 3, 2025 to conspiracy to commit wire and mail fraud, money laundering conspiracy, and conspiracy to commit identity theft. Zhenxing Wang pleaded guilty in January 2026 to conspiracy to commit wire and mail fraud and money laundering conspiracy. US District Judge Nathaniel M. Gorton sentenced Kejia Wang to 108 months and Zhenxing Wang to 92 months in prison, sentences imposed the week of April 13, 2026 and announced by the Justice Department on April 15. The judge ordered three years each of supervised release and forfeiture of $600,000 between the two men, of which $400,000 had been received as of the announcement, and ordered Kejia Wang alone to pay $29,236.03 in restitution.

The action was part of a coordinated nationwide DOJ, FBI, DCIS and HSI effort that searched 29 known or suspected laptop farms across 16 states and seized 29 financial accounts, 21 fraudulent websites and roughly 200 computers. A separate Northern District of Georgia indictment charged four North Korean nationals, all at large and none convicted, with stealing virtual currency worth over $900,000 at the time of the thefts from two employers: approximately $740,000 from an Atlanta-based blockchain research and development firm and approximately $175,000 from a Serbia-based virtual token company.

Why it matters

This is one of the most fully documented US prosecutions of the DPRK's remote-IT-worker revenue scheme, and what it documents is identity fraud rather than synthetic media. Three ordinary controls failed in sequence and none of them involved a camera. The identity was real, belonging to an American whose name, address, date of birth and Social Security number had been verified against a commercial background-check service before it was ever used, which means the background check confirmed the identity precisely because the identity was genuine. The documents were forged to match it, and the employment eligibility attestation was signed under penalty of perjury. The domestic presence was manufactured by shipping the company's own laptop to a US residence and letting someone else plug it into a KVM switch.

Nothing in the charged conduct required defeating a video interview, so deepfake detection would have stopped none of it. The teaching point is that the decisive signals sit on either side of the interview rather than inside it: identity and document verification before hire, and device, network and payroll telemetry after it. An employer watching for a laptop that authenticates from an unexpected country, remote-access software installed the week the machine was provisioned, or a payroll deposit routed to a business entity instead of the named employee would have seen this scheme running. It also shows the national-security tail on what looks at first like payroll fraud: one of these fraudulently obtained accounts became the route by which ITAR-controlled technical data left a defense contractor.

Defenses

No hiring guidance was issued alongside this prosecution. The only advice in the April 2026 sentencing release is one sentence from the FBI: organizations should "closely monitor their data, strengthen their remote hiring processes, and report any suspicious activity or fraud to the FBI." The Justice Department points instead to standing advisories, the FBI public service announcements of May 2024, January 2025 and July 2025 and the May 2022 State, Treasury and FBI advisory, as the place where red-flag indicators and mitigations for this scheme actually live.

The specific hiring controls below come from the two vendor reports, named so a reader can check them. Microsoft's Jasper Sleet research recommends confirming a candidate has an authentic digital footprint including a real, non-VoIP phone number; scrutinizing resumes and background checks for consistency of names, addresses and dates; contacting references by phone or video-teleconference rather than email only; applying heightened scrutiny to staffing-company placements; checking whether a persona is employed at several companies at once; seeing the candidate on camera across multiple sessions and treating persistent video or microphone problems as a red flag; asking the person to hold a physical identity document up to the camera during verification; monitoring for impossible travel and for public VPNs such as Astrill; and using application control to block unapproved RMM tools. Unit 42's False Face report adds document authenticity forensics, ID verification with integrated liveness detection, matching the interviewee against the presented document, recording application IP addresses, enriching phone numbers to detect VoIP carriers, and blocking virtual-webcam software on corporate devices where there is no business case for it.

Two further controls follow from the charged conduct in this case rather than from published guidance, and they are the ones that would have bitten here: verify that a laptop shipping address matches the hire's stated home address before equipment ships, treating a post-offer address change as a flag, and confirm that a payroll destination account belongs to the named employee rather than to a third-party company.