The U.S. Department of Justice announced the sentencing of two U.S. nationals, Kejia Wang and Zhenxing Wang, for facilitating North Korean remote information technology workers who posed as U.S. residents to obtain remote jobs at more than 100 U.S. companies. The scheme used the stolen identities of at least 80 U.S. persons and generated more than USD 5 million in illicit revenue for the Democratic People’s Republic of Korea. Kejia Wang received a 108-month prison sentence after pleading guilty to conspiracy to commit wire fraud, money laundering, and identity theft, while Zhenxing Wang received 92 months after pleading guilty to conspiracy to commit wire fraud and money laundering. The court also imposed three years of supervised release on each defendant, ordered forfeiture totaling USD 600,000 (with USD 400,000 already received by the United States), and required Kejia Wang to pay USD 29,236.03 in restitution. Court documents describe “laptop farms” in which U.S.-based facilitators hosted victim-company laptops at their residences and used devices such as keyboard-video-mouse switches to enable overseas remote access; the defendants also created shell companies and related financial accounts to receive proceeds, which were then transferred overseas, while victim companies incurred at least USD 3 million in legal and remediation costs. The release further notes that overseas co-conspirators accessed sensitive employer data and source code, including information marked as controlled under the International Traffic in Arms Regulations from a California-based defense contractor. Eight other defendants indicted in June 2025 remain at large, and the U.S. Department of State’s Rewards for Justice program announced rewards of up to USD 5 million for information leading to the disruption of financial mechanisms supporting the DPRK, including in relation to the fugitives named in the case and one suspected IT worker. The Justice Department framed the action as part of its DPRK RevGen: Domestic Enabler Initiative, and referenced prior seizures of domains and financial accounts tied to the scheme as well as earlier sentencings of other facilitators.