WASHINGTON (WKRN) \u2014 The U.S. Department of Justice announced Wednesday that two men \u2014 including a Nashvillian \u2014 have been sentenced in separate cases for helping remote information technology workers from the Democratic People\u2019s Republic of Korea (DPRK).<\/p>\n
According to officials, Matthew Isaac Knoot of Nashville, and Erick Ntekereze Prince of New York, both received and hosted laptops at their homes that U.S. companies shipped to IT workers they had hired, who the companies believed were located at those residences.<\/p>\n
In addition, Knoot and Prince reportedly installed remote desktop applications on laptops that gave their co-conspirators the ability to work from locations overseas while appearing to the victim companies to be working from the men\u2019s residences.<\/p>\n
AUGUST 2024 | North Korean remote IT worker fraud schemes disrupted through arrest of Nashville facilitator: DOJ <\/a><\/p>\n These separate fraud schemes generated a total of more than $1.2 million in revenue for the DPRK and affected nearly 70 victim companies in the U.S., the DOJ said.<\/p>\n \u201cThese sentences hold accountable U.S nationals who enabled North Korea\u2019s illicit efforts to infiltrate U.S. networks and profit on the back of U.S. companies,\u201d said Assistant Attorney General for National Security John A. Eisenberg. \u201cThese defendants helped North Korean \u2018IT workers\u2019 masquerade as legitimate employees, compromising U.S. corporate networks and helping generate revenue for a heavily sanctioned and rogue regime. The National Security Division will continue to pursue those who, through deception and cyber-enabled fraud, threaten our national security.\u201d<\/p>\n \u201cThe FBI and our partners will continue to disrupt North Korea\u2019s ability to circumvent sanctions and fund its totalitarian regime,\u201d said Assistant Director Brett Leatherman of the FBI\u2019s Cyber Division. \u201cThese cases should leave no doubt that Americans who choose to facilitate these schemes will be identified and held accountable. Hosting laptops for DPRK IT workers is a federal crime which directly impacts our national security, and these sentences should serve as a warning to anyone considering it.\u201d<\/p>\n The DOJ said U.S. District Court Judge Darrin P. Gayles for the Southern District of Florida sentenced Prince to 18 months in prison, followed by three years of supervised release, and ordered him to forfeit $89,000, which is the amount the DPRK IT workers paid him for helping with the scheme.<\/p>\n CRIME TRACKER | Read the latest crime-related reports from across Middle Tennessee <\/a><\/p>\n As for Knoot, U.S. District Court Judge Eli Richardson for the Middle District of Tennessee sentenced the Nashvillian to 18 months in prison followed by one year of supervised release. In addition, Knoot was ordered to pay $15,100 in restitution to the victim companies, as well as forfeit another $15,100 since that was how much the DPRK IT workers paid him for his assistance, according to officials.<\/p>\n Based on court documents, Knoot ran a laptop farm from his Nashville homes from about July 2022 until August 2023. After the victim companies shipped laptops addressed to \u201cAndrew M.\u201d to Knoot\u2019s residences, he would log onto the laptops, download and install unauthorized applications, and access the companies\u2019 networks without authorization. Those remote applications enabled a North Korean IT worker to work from locations in China while giving the victim companies the impression that \u201cAndrew M.\u201d was working from Knoot\u2019s homes in Nashville.<\/p>\n The DOJ announced in August 2024 that Knoot was indicted and arrested for \u201cparticipating in a criminal scheme that obtained work for North Korean IT workers from at least four U.S. companies.\u201d<\/p>\n Officials said the victim companies paid the DPRK IT workers associated with Knoot\u2019s laptop farm more than $250,000 for their work between July 2022 and August 2023. Most \u2014 if not all \u2014 of that money was falsely reported to the Internal Revenue Service and Social Security Administration under the name of the actual Andrew M., whose identity was stolen by the conspirators.<\/p>\n \ud83d\udce7\u00a0Have breaking news come to you:\u00a0Subscribe to News 2 email alerts<\/a> \u2192<\/p>\n \u201cKnoot\u2019s and his conspirators\u2019 actions also caused the victim companies more than $500,000 in costs associated with auditing and remediating their devices, systems, and networks,\u201d Officials said Knoot\u2019s role in the scheme ended when the FBI searched his home in August 2023, after which Knoot made multiple false and misleading statements and destroyed evidence to obstruct the investigation.<\/p>\n \u201cThese kind of foreign-based attacks on American businesses will not be tolerated and those involved will be held accountable for their actions,\u201d said U.S. Attorney Braden H. Boucek for the Middle District of Tennessee. \u201cThis case demonstrates our coordinated effort with federal law enforcement to protect businesses in Tennessee and across the country.\u201d<\/p>\n The FBI Nashville Field Office investigated the case, which was reportedly prosecuted by former Assistant U.S. Attorney Josh Kurtzman for the Middle District of Tennessee and Trial Attorney Gregory J. Nicosia Jr. of the National Security Division\u2019s National Security Cyber Section, with assistance from Paralegal Specialist Shelby Duty.<\/p>\n \u23e9\u00a0Read today\u2019s top stories on wkrn.com<\/a><\/p>\n In a release<\/a> issued on Wednesday, May 6 about Knoot and Prince\u2019s sentences, the DOJ said, in part:<\/p>\n Today\u2019s announcement represents the Department\u2019s latest actions to combat North Korean IT worker schemes as part of a joint NSD and FBI Cyber and Counterintelligence Divisions effort, the DPRK RevGen: Domestic Enabler Initiative. This effort prioritizes targeting and disrupting the DPRK\u2019s illicit revenue generation schemes and its U.S.-based enablers. The Department previously announced other actions pursuant to the initiative, including in\u00a0January 2025<\/a>,\u00a0June 2025<\/a>,\u00a0November 2025<\/a>, and\u00a0April 2026<\/a>.<\/p>\n As described in Public Service Announcements published in\u00a0May 2024<\/a>,\u00a0January 2025<\/a>, and\u00a0July 2025<\/a>, North Korean remote IT workers posing as legitimate remote IT workers have committed data extortion and exfiltrated the proprietary and sensitive data from U.S. companies. DPRK IT worker schemes typically involve the use of stolen identities, alias emails, social media, online cross-border payment platforms, and online job site accounts, as well as false websites, proxy computers, and witting and unwitting third parties located in the U.S. and elsewhere.\u00a0 North Korean IT workers leverage these third parties, which include U.S.-based individuals, to gain fraudulent employment and access to U.S. company networks to generate this revenue.<\/p>\n Other public advisories about the threats, red flag indicators, and potential mitigation measures for these schemes include a\u00a0May 2022<\/a>\u00a0advisory released by the FBI, Department of the Treasury, and Department of State; a\u00a0July 2023<\/a>\u00a0advisory from the Office of the Director of National Intelligence; and guidance issued in\u00a0October 2023<\/a>\u00a0by the United States and the Republic of Korea (South Korea). As described the May 2022 advisory, North Korean IT workers have been known individually to earn up to $300,000 annually, generating hundreds of millions of dollars collectively each year, on behalf of designated entities, such as the North Korean Ministry of Defense and others directly involved in the DPRK\u2019s weapons programs.<\/p>\n According to officials, the U.S. Department of State has offered rewards of up to $5 million<\/a>\u00a0for information that helps disrupt the DPRK\u2019s illicit financial activities, including cybercrimes, money laundering, and sanctions evasion.<\/p>\n Copyright 2026 Nexstar Media, Inc. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.<\/p>\n
the DOJ explained.\u00a0\u201cKnoot and the DPRK IT workers conspired to receive payments from the victim companies and transfer those funds to Knoot and to accounts outside of the United States, including accounts associated with North Korean and Chinese individuals.\u201d<\/p>\n