A Nashville local, 38-year-old Matthew Knoot, faces charges for allegedly aiding North Korean officials to secure IT positions within companies in the U.S. and the U.K. The Justice Department accuses Knoot of assisting North Koreans in assuming false U.S. identities and operating a “laptop farm” from his residence, enabling remote logins from China.
The indictment reveals that these individuals, masquerading as an American named “Andrew M.,” gained employment in sectors including media, technology, and finance. Knoot is also suspected of funneling the proceeds from these jobs to North Korean and Chinese entities.
U.S. Attorney Henry Leventis has indicated that Knoot’s actions may have channeled substantial funds to North Korea. The operation, which spanned from July 2022 to August 2023, involved shipping laptops to Knoot’s address under the alias “Andrew M.”
Investigations have uncovered payments to Knoot from a coordinator, Yang Di, and tax filings under the stolen identity. The implicated IT workers reportedly earned over $250,000 each.
Knoot could face up to 20 years in prison on charges of money laundering, wire fraud, and identity theft if convicted.
The broader context involves North Korea deploying IT professionals globally to sidestep sanctions and support its weapons initiatives. The U.S. has taken steps to dismantle this network, including shutting down related websites and seizing funds.
This case follows a similar charge against Christina Chapman and is part of a concerted effort by U.S. authorities to combat the exploitation of business infrastructures by North Korean operatives.
