Ukrainian Man Sentenced to Five Years for Facilitating North Korean IT Worker Scheme
Summary
Oleksandr Didenko was sentenced to five years after pleading guilty to helping North Korean IT workers obtain U.S. jobs using stolen identities and hosted laptops. Authorities said the scheme affected at least 871 identities and harmed victims and employers.
Key points
- Didenko pleaded guilty to wire fraud and aggravated identity theft and was sentenced to five years in prison.
- He operated Upworksell[.]com, which prosecutors said helped North Korean workers obtain stolen or rented U.S. identities and fake documents.
- The scheme placed North Korean IT workers at about 40 U.S. companies and gave Didenko access to identities belonging to at least 871 Americans.
- Seventeen laptops hosted in U.S. homes were seized in May 2024; hosts were reportedly paid about $100 per month.
- At least 18 people had identities stolen, and 13 incurred false tax liabilities. Victims also faced benefits and employment-eligibility problems.
- Didenko agreed to forfeit $1.4 million. The Justice Department seized the Upworksell[.]com domain in 2024.
Article Details
- Event Type
- Sentencing after a guilty plea for wire fraud and aggravated identity theft tied to a scheme facilitating North Korean IT workers' fraudulent employment at U.S. companies.
- Impact
- The scheme placed North Korean IT workers at roughly 40 U.S. companies and involved access to identities of at least 871 Americans. At least 18 people had identities stolen, and 13 faced false tax liabilities; victims also experienced benefits and employment-eligibility problems. Companies incurred security-review, hiring, onboarding, and training costs, and some did not recover company laptops. Didenko was sentenced to five years and agreed to forfeit $1.4 million.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | upworksell[.]com | Domain operated by Didenko for a service that sold or rented stolen U.S. identities and facilitated the fraudulent IT-worker scheme; the Justice Department seized it in 2024. |
People
Threat Actors
Christina ChapmanWas sentenced to eight-and-a-half years for running an Arizona laptop farm that facilitated the North Korean IT-worker scheme.Oleksandr DidenkoPleaded guilty to wire fraud and aggravated identity theft and was sentenced for facilitating the fraudulent IT-worker scheme, including arranging stolen identities and U.S.-hosted laptops. Prosecutors said he participated in virtually every aspect of the scheme; Didenko claimed he did not know he was assisting North Korea until 2024.
Countries
ChinaHe sent 175 payments to accounts based in Dandong, China, a city on the border with North Korea.North KoreaNorth Korea’s government has brought in hundreds of millions of dollars by infiltrating American tech companies in high-paying roles with workers posing as U.S.PolandThe Justice Department seized the Upworksell.com domain in 2024 and Didenko was arrested in Poland and extradited to the U.S.UkraineRead More: https://therecord.media/north-korea-laptop-farm-ukraineUnited StatesA Ukrainian national, Oleksandr Didenko, was sentenced to five years after admitting he ran Upworksell.com, a service that sold or rented stolen U.S.