A U.S. federal court has sentenced a Ukrainian man to five years in prison for his role in a long-running identity theft operation that helped overseas North Korean workers gain fraudulent employment at dozens of U.S. companies.
In 2024, U.S. prosecutors indicted Oleksandr Didenko, a 29-year-old resident of Kyiv, on charges of stealing the identity of a U.S. citizen and arranging to hire North Koreans for wages. Under the plan, the workers' earnings were returned to North Korea, which the regime used to fund its internationally sanctioned nuclear weapons program.
This is the latest in a series of recent convictions for individuals involved in promoting North Korea's ongoing so-called “IT workers” program. Security researchers say North Korean workers are a “triple threat” to U.S. and Western companies because they violate U.S. sanctions and at the same time North Korea can steal companies' sensitive data and then force victim companies not to publicly release trade secrets.
Prosecutors said Didenko operated a website called UpworkCell, where people working abroad, including North Koreans, could buy or rent stolen identification cards to get jobs at U.S. companies. Didenko handled more than 870 cases of stolen personal information, according to the Department of Justice.
The FBI seized Upwork Cell in 2024 and diverted its traffic to its own servers. Polish authorities arrested Didenko and he was later extradited to the United States, where he pleaded guilty.
A screenshot showing the Upworksell website at the time it was seized by the FBI. (Image: TechCrunch/Screenshot)
The U.S. Department of Justice said in a statement this week that Didenko also paid people to receive and host computers in their homes in California, Tennessee and Virginia. These “laptop farms” are rooms with open racks of laptops that allow North Koreans to work remotely as if they were physically in the United States.
Security giant CrowdStrike announced last year that it was seeing a surge in the number of North Korean workers entering companies as remote developers and other technical software engineering jobs. The scheme is one of many that the North Korean regime uses to enrich itself while being unable to tap into the global financial system thanks to international sanctions.
North Korea has also been known to impersonate recruiters and venture capitalists to trick unsuspecting celebrity and wealthy victims into granting access to their computers containing virtual currency.