Counterintelligence & Tradecraft — 2026-05-11

DOJ Sentences Two U.S. Nationals for Running DPRK IT Worker Laptop Farms

Help Net Security reported May 9 that a federal court sentenced Matthew Isaac Knoot of Nashville and Erick Ntekereze Prince of New York to 18 months in prison for operating North Korean IT worker laptop farms. Together, their schemes placed workers at nearly 70 U.S. companies and generated more than $1.2 million for Pyongyang; both men received company-issued laptops at their residences and installed remote desktop software to make overseas workers appear U.S.-based. Knoot's operation, which ran from July 2022 through August 2023, caused more than $500,000 in auditing and remediation costs; Prince ran his scheme through Taggcar Inc. from June 2020 through August 2024. Prosecutors identified these as the seventh and eighth convictions of U.S.-based laptop farmers secured in five months.

Analysis
Eight U.S. convictions in five months mark a shift from isolated enforcement to systematic interdiction, per a single Help Net Security report citing named DOJ and FBI officials. DOJ will very likely secure additional convictions within the next twelve months, driven by stated crackdown posture and a facilitator network that extended well beyond these two cases. The 18-month sentences, however, are unlikely to suppress new facilitator recruitment: combined financial penalties of roughly $119,000 against more than $1.2 million generated preserve strong economic incentives. Prosecution may instead be concentrating on visible, unsophisticated operators while more insulated intermediaries, including shell companies and overseas proxies, continue placing DPRK workers at scale without disruption.

1 sources

Helping North Korean IT remote workers is becoming a fast track to prison - Help Net Security