A 40-year-old Maryland man could face decades in prison for allegedly collaborating with foreign nationals in China to secure remote IT jobs at 13 US companies from 2021 to 2024. According to Fortune, Minh Phuong Ngoc Vong earned over $970,000 in salaries for software development work, which authorities claim was performed by North Korean operatives based in Shenyang, China, according to the Department of Justice.
The China-based developers, posing as employees in remote IT jobs, including contracts with US government agencies like the Federal Aviation Administration, accessed sensitive government systems from overseas, authorities said. The Department of Justice alleges the Maryland man's scheme is part of a broader fraud operation where North Korean nationals, working with US facilitators, use false identities to secure remote IT jobs, perform work from Russia or China, and illegally funnel salaries to North Korea's leader, Kim Jong Un.
A large-scale conspiracy has resulted in numerous indictments, involving individuals who hosted "computer farms" in their homes. These farms housed company-issued laptops, making it appear as though work was being done in the US. The scheme is estimated to generate $250-600 million annually, funding North Korea's nuclear weapons program. US agencies report thousands of North Korean IT workers have been hired by Fortune 500 companies in recent years.
Vong allegedly conspired with developers in China, including an individual known as "William James," whom authorities believe to be a North Korean national, along with other unidentified co-conspirators. According to court records, Vong told an FBI agent that "James" contacted him via a cell phone video game app, claiming Vong could "legally" earn money by securing remote IT jobs and sharing his computer access credentials with James. This enabled James and others to perform software development work for U.S. companies under Vong's identity, as part of a broader scheme to defraud companies and access sensitive US government systems, with Vong earning over $970,000 (Rs 8,25,52,629) in salaries.
According to the Department of Justice and court documents, Vong allegedly allowed conspirators to create a fake resume on his behalf. The fraudulent resume claimed he had a degree from the University of Hawaii, 16 years of experience as a software developer, and a previous secret-level security clearance. However, Vong, who worked at a nail and spa salon, lacked both the degree and development experience claimed in the false resume.
At one of the 13 jobs, Vong allegedly participated in an online interview with a senior software developer, who recommended him for the position and took a screenshot during the meeting. The CEO of the Virginia-based company later hired him after a final interview where Vong reportedly displayed his Maryland driver's license and US passport to verify his identity, with the company taking a second screenshot of him holding these documents. Court records indicate authorities believe the screenshots depict two different individuals: one, allegedly a North Korean IT worker impersonating Vong, and the other, the real Vong from Maryland holding his identification.
Vong was assigned to work on an FAA contract involving aviation asset monitoring software used by government agencies. He was provided a MacBook Pro laptop and a Personal Identity Verification card for access to government facilities and systems. Vong allegedly installed remote access software, allowing others to control the device from China.
From March to July 2023, the Virginia company paid Vong over $28,000 for work performed by "William James" and others, per the DOJ. Someone posing as Vong attended Zoom meetings and discussed tasks daily. As part of his guilty plea, Vong admitted the Virginia job was one of 13 companies that hired him from 2021 to 2024, several with US government contracts, including the FAA. The Virginia company fired Vong after discovering he held another job during a Defence Counterintelligence and Security Agency clearance check.
After Vong's termination, the Virginia company's CEO showed his picture to the senior developer who had recommended him. The developer confirmed the person in the photo, identified as Vong, was not the individual he interviewed, screenshotted, or who participated in daily virtual meetings and performed the work. He pleaded guilty to conspiracy to commit wire fraud and faces up to 20 years in prison.
