Danton personnel involved in North Korea remote IT network: how computers sent by American companies become a cross-border financial tool

A United States enterprise has hired remote programmers in accordance with the recruitment process and sent office computers to the receiving address in Pennsylvania. The equipment arrived in the United States and the people who really controlled it could be overseas. On October 13, the United States Department of Justice released a case of transnational IT recruitment fraud </a": the prosecution charged that the persons involved had entered over 70 United States businesses under false name, obtained workbooks and salaries, and obtained additional assistance. Computers that remain at the United States address mask the actual place of entry. Cumulative income over the years exceeded $3 million.

The most interesting thing about this case for Chinese readers is not how much money American companies have been paid, but what's going on is that the American company is being paid.https://www.justice.gov/opa/media/1465576/dl?inline="target" rel= "nopener noreferrer" data-linked-reference= "tru" data-reference-label= "58 Pages of Federal Indictment" > A list of addresses in China's Indictment : Liao Ningdong, other parts of Liao Ning and Shenzhen Guangdong. The prosecution has made public the cases of Sun Sheng Ming, Wang Jian Jun, Han Guo Bin, Zhang Wei Ping and Sheng Zhang Kun. The indictment places organizers, remote operators and United States-based facilitators in China in the same chain of cross-border employment and transfer of funds.

Dandong, located along the Green River, is an important port of entry for trade between China and the Democratic People ' s Republic of Korea. The multiple accused listed by the prosecution are active here, leaving a specific geographical issue that is often seen as an abstract “sanctions circumvention”: how people outside the country can take up United States positions, how to collect remuneration and through which accounts and intermediaries to transfer revenues. The existence of the respective regulatory bodies for trade, accounts and the movement of people at the border between China and the Democratic People ' s Republic of Korea, and the long-term functioning of the cross-border revenue network, reflect the gap between local commercial and financial activities that can be exploited by these participants.

The other end of the network is the common home on the mainland of the United States. The United States Department of Justice has alleged that facilitators have used stolen or falsified United States identity materials to recruit and help companies to send laptops into remote control systems. A personnel supervisor saw the legal entry process: video interviews, identification, company mailboxes and a fixed United States receiving address. The moment when the company's authority is actually surrendered often happens when the equipment is activated and the employer creates an Intranet account. Thereafter, the salary entered a seemingly normal staff payment process.

The prosecution has declared the identity of two United States-based facilitators: Michael James Bostelle, based in Pennsylvania, and Juan Cecelio Pena Carrillo, based in Texas. Two persons accused of involvement in the equipment, account or financial connection were arrested. Federal criminal charges include wire transfer fraud, money-laundering conspiracy and identity theft. For United States citizens with an impersonated identity, more than personal information is damaged; Access to company payroll records, tax information and business systems may also be involved in this chain.

Meanwhile,https://www.justice.gov/opa/pr/justice-department-announces-coordinated-actions-combat-north-korean-remote-it-worker"target" rel = "nopener noreferrer" data-linked-reference= "true" data-reference-label = "DoJ Coordinate Law Enforcement Bulletin" , published by the United States Department of Justice, "Slender Stars Roundup" in Texas, searching and seizing about 187 units in multiple homes. Law enforcement operations in different regions have collectively revealed a very simple technical arrangement: computers are located in the United States and remote users are sitting outside the country. A common room with laptops, network connections and remote control tools can become a key point for cross-border recruitment fraud. Previously, the FBI had issued live photographs of residential computers, which had given this organization a visual shape.

US Department of Justice links the activities of Korean remote IT personnel to the evasion of sanctions and the financing of the North Korean regime. Persons in China who are on this indictment are at the intersection of enterprise recruitment, operations outside the country and salary movements. The accounts, equipment and payment relationships they have handled are more likely to explain how the financial networks under sanctions can profit from normal business activities than “where the cyber attacks come from”.

The Xi Jinping regime has long placed emphasis on strict regulation of cross-border financial activities, cyber platforms and movement of people at borders. The presence of a number of public judicial records of the individuals involved in the case in Dandong has made this highly regulated gap with the physical underground network visible. While administrative powers can examine in depth the cross-border financing and communications activities of ordinary people, long-range, commercially packaged employment, collection accounts and cross-border settlements may still form a long-term operating chain. What is critical here is the contrast between the expansion of political control and the governance of specific cross-border grey networks.

The time frame for tracking cases has been extended from 2019 to July

1. Over 70 employers pay for their work, deliver equipment in accordance with normal personnel procedures, and in some cases submit source codes to the use of internal resources to impersonate employees. Prosecutions and equipment seizures on 13 October ended the activities of some of the participants, but did not allow for the automatic restoration of the exposed business access and stolen identity. The enterprise also has an employee file at this time, and those registered on the file are not necessarily those who have been in the system for many years.