US Nationals Sentenced for Facilitating North Korean IT Worker Scheme
Two US nationals, Matthew Issac Knoot and Erick Ntekereze Prince, were sentenced to 18 months in prison for running laptop farms that facilitated North Korea's expansive remote IT workers scheme, the Justice Department said. The pair's separate schemes impacted almost 70 US companies and generated a combined $1.2 million in revenue for the North Korean regime.
The FBI and its partners will continue to disrupt North Korea's ability to circumvent sanctions and fund its totalitarian regime, according to Brett Leatherman, lead of the FBI's Cyber Division. "These cases should leave no doubt that Americans who choose to facilitate these schemes will be identified and held accountable. Hosting laptops for DPRK IT workers is a federal crime which directly impacts our national security, and these sentences should serve as a warning to anyone considering it."
Prince's Involvement in the Scheme
Prince, of New York, received laptops from unsuspecting US companies and installed remote desktop applications on the machines to enable co-conspirators to work from anywhere while appearing to be based at their respective residences. His company, Taggcar, was contracted to supply IT workers to victim US companies from June 2020 through August 2024. Prince pleaded guilty in November 2025 to wire fraud conspiracy for his years-long involvement in the North Korean IT worker scheme.
Prince was indicted and charged in January 2025 along with his alleged co-conspirators, who collectively obtained work for North Korean IT workers at 64 US companies, earning nearly $950,000 in salary payments. A federal judge sentenced Prince and ordered him to forfeit $89,000, which is the amount he netted personally.
Knoot's Involvement in the Scheme
Knoot, of Nashville, Tennessee, was arrested in August 2024, a year after the FBI searched his home. Officials said he made multiple false and misleading statements and destroyed evidence to obstruct the investigation at that time. Victim companies paid North Korean workers linked to Knoot's laptop farm more than $250,000 from July 2022 to August 2023.
The remote IT workers transferred those funds to Knoot and accounts associated with North Korean and Chinese nationals, officials said. Knoot was sentenced on May 1 and ordered to pay $151,000 in restitution to the victim companies and forfeit an additional $151,000, which is equivalent to the amount of his direct take from the scheme.
Countermeasures Against the Scheme
The pair of North Korean operatives join a growing list of people who have been charged and jailed for supporting the regime's scheme that generates hundreds of millions of dollars annually for the country's military and organizations involved in its weapons programs. Authorities have been cracking down on the malicious insider activity by seizing cryptocurrency linked to the theft, and targeting US-based facilitators who provided forged or stolen identities and hosted laptop farms for North Korean operatives.
Federal judges previously sentenced other people to prison for their involvement in the scheme, including Keija Wang and Zhenxing Wang; Audricus Phagnasay, Jason Salazar, and Alexander Paul Travis; and Oleksandr Didenko and Christina Chapman. "These sentences hold accountable US nationals who enabled North Korea's illicit efforts to infiltrate US networks and profit on the back of US companies," said John A. Eisenberg, assistant attorney general for national security.
"These defendants helped North Korean 'IT workers' masquerade as legitimate employees, compromising US corporate networks and helping generate revenue for a heavily sanctioned and rogue regime," he added. "The National Security Division will continue to pursue those who, through deception and cyber-enabled fraud, threaten our national security."
Source: CyberScoop