Nail salon employee pleads guilty after holding 13 remote IT jobs worked by developers in China
Minh Phuong Ngoc Vong, 40, of Bowie, Maryland will be sentenced in August after he pleaded guilty to conspiracy to commit wire fraud this month. Vong's guilty plea is the latest intrigue in what authorities say is a vast fake IT worker scheme that funds North Korea's illegal nuclear weapons and ballistic missile program. Authorities alleged Vong essentially rented out his U.S. identity to developers based in China who used it to get more than a dozen remote tech jobs, some of which involved contract work for sensitive government agencies.
A 40-year-old Maryland man is facing decades in prison after he allegedly worked with foreign nationals in China to get remote work IT jobs with at least 13 different U.S. companies between 2021 and 2024. The jobs paid him more than $970,000 in salary for software development tasks that were actually performed by operatives authorities allege are North Korean and working out of a post in Shenyang, China, according to the Department of Justice.
The China-based developers used the company IT jobs, some of which involved contracting out software services to U.S. government agencies like the Federal Aviation Administration, to get access to highly sensitive government systems that they logged into from overseas, authorities said. According to the Department of Justice, the Maryland man's scheme is part of a vast fraud operation in which trained North Korean nationals work with American facilitators to fraudulently obtain remote-work IT jobs under various identities, do the work from Russia or China, and then illegally remit their salaries to Kim Jong Un, authoritarian leader of the Democratic People's Republic of Korea (DPRK).
There have been dozens of indictments in the conspiracy, including Americans who have pleaded guilty to hosting computer farms, where they keep dozens of company-issued laptops in their homes for a fee so that it appears the work is being done in the U.S. The UN has estimated the scheme generates revenues between $250 million and $600 million each year and funds North Korea's illegal nuclear weapons program. The FBI, State Department, and Department of Justice say thousands of DPRK IT workers have been hired for positions at hundreds of Fortune 500 companies in recent years.
In the case involving Maryland man Minh Phuong Ngoc Vong, the DOJ claims he worked in league with developers in China, including one who called himself 'William James.' Court records show authorities believed James and other John Does in the scheme are natives of North Korea. Vong allegedly told an FBI agent 'William' approached him through a cell phone video game app and told Vong he could 'legally' make money by getting development jobs and then giving William his computer access credentials.
According to the DOJ and court documents, Vong allegedly let James and the other unnamed conspirators draw up a fraudulent resume for him saying he had a degree from the University of Hawaii, 16 years of experience as a software developer, and had previously maintained a secret-level security clearance. The DOJ said Vong, who worked in a nail and spa salon, had neither a degree nor did he have experience in development.
At one of the 13 jobs, someone who identified himself as Vong allegedly joined an online interview with a senior software developer who recommended he get the job and took a screenshot of him during the meeting. The CEO of the Virginia-based company later hired him after a successful final interview in which Vong allegedly showed his Maryland driver's license and U.S. passport to confirm his identity, and the company screenshotted Vong a second time holding up the documents. (Court records show authorities believe these screen grabs are of two different people—one who is allegedly a North Korean IT worker posing as Vong, and another who is the real Vong from Maryland holding his license and passport.)
The company set Vong to work on an FAA contract that involved an application monitoring aviation assets in flight in the U.S, according to court records. The software is used by government agencies such as the Department of Defense, Department of Homeland Security, and Secret Service. The Virginia company shipped Vong a MacBook Pro laptop with administrative rights to download software and the FAA let Vong have a Personal Identity Verification card to get him into government facilities and systems, court records show. Vong allegedly installed remote access software on the company device so that James and his cohort could use it from China.
Between March and July in 2023, the Virginia company paid Vong more than $28,000 while the work was performed by James and other unknown people, the DOJ said. During his time there, someone known as Vong attended Zoom meetings for work and spoke to his team about his task list at a daily meeting. As part of his guilty plea, Vong admitted the Virginia job was only one among 13 different companies that hired him between 2021 and 2024. Several did contract work for the U.S. government, in addition to the FAA. Vong got fired by the Virginia company after it submitted his information to the Defense Counterintelligence and Security Agency for a secret clearance and found out he might have another job.
After he was fired, the CEO showed Vong's picture to the senior developer who initially recommended him. The developer told the CEO that the individual he called "Vong" in the photo wasn't the same "Vong" he had initially interviewed and screenshotted. He also wasn't the person who participated in daily virtual meetings and did work.
Vong pleaded guilty to conspiracy to commit wire fraud and is facing 20 years in prison. Reached by phone, Vong declined to comment.
Michael "Barni" Barnhart, principal insider risk investigator at Dtex Systems, told Fortune in a statement the continued efforts by U.S. law enforcement to expose and disrupt the North Korean IT worker operations and the facilitators who enable them are positive advancements.
"These indictments are another critical step in thwarting adversarial operations," said Barnhart in the statement. Still, Barnhart said his group has directly observed IT workers trying to get other highly sensitive jobs, including positions with clearance within the U.S. government and third-party contractors for federal agencies.
Furthermore, in a report published this month, Google's Threat Intelligence Group revealed the scheme is expanding, and one DPRK worker late last year operated at least 12 personas across Europe and the U.S., and was looking for more jobs in European defense and with government contractors. Other investigations found fake IT worker identities seeking jobs in Germany and Portugal, according to the latest report.
'Even if these actors are primarily financially motivated, the risk they pose to critical infrastructure is enormous,' John Hultquist, chief analyst at Google's Threat Intelligence Group, told Fortune. 'This scheme has become so widespread that targeting of these organizations is almost inevitable. Given their connection to the intelligence services, that kind of access could be a nightmare.'
The FBI's Baltimore office is investigating the case.
This story was originally featured on Fortune.com
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Boston Globe
28 minutes ago
- Boston Globe
LA stands up to ICE raids. What about Boston?
In fact, Boston activists did rally on Monday in an act coordinated by Service Employees International Union members in support of David Huerta, a prominent labor and civil rights leader in California and SEIU United Service Workers West president, who Get The Gavel A weekly SCOTUS explainer newsletter by columnist Kimberly Atkins Stohr. Enter Email Sign Up Related : Advertisement 'When somebody is violently detained as David [Huerta] was — arrested and detained — we're going to stand up and make our voices heard. This is bringing it all to a new level,' Kevin Brown, executive vice president of SEIU 32BJ, told me in an interview before the Monday rally. SEIU 32BJ — which represents more than 185,000 members in a dozen states, including 21,000 in Massachusetts and Rhode Island — calls itself the largest immigrant-majority union membership in the country. Advertisement 'Of course, it's not just about David … this is about the ICE raids, and this is about a fundamental attack on democracy,' Brown said. 'When you mobilize 2,000 National Guard [members], you threaten to bring in the Marines over the objections of the governor and the mayor. ... Yeah, this is pretty bad.' Lucy Pineda, a longtime activist and founder and director of the nonprofit Latinos Unidos en Massachusetts, has been documenting ICE activity daily on social media primarily in Chelsea, East Boston, Everett, and Lynn. '¿Hasta cuándo el pueblo se va a levantar?' When will the people rise up?, Pineda's voice was emotional when she picked up my call Monday morning as she told me about a heart-wrenching ICE raid in Lynn Advertisement ICE's activity in LA seemingly signals a new phase in Trump's immigration crackdown, one that local advocates have been bracing for: workplace raids. To be sure, White House deputy chief of staff Stephen Miller, the force behind Trump's immigration plans, has reportedly put pressure on ICE leaders to ' 'What do you mean you're going after criminals?' That flood has begun. But so has the resistance. 'We've been preparing for this level of activity from the Trump administration since he was elected in November,' Brown said. 'We will absolutely do everything that we can lawfully engage in to protect our members' rights.' Advertisement 'Americans are stunned,' David Leopold, an immigration lawyer and former president of the American Immigration Lawyers Association, told me. 'What they voted for was a secure border. What they got is a full-on military-style assault on immigrants.' Marcela García is a Globe columnist. She can be reached at
Boston Globe
28 minutes ago
- Boston Globe
Trump's latest manufactured crisis has Los Angeles in its grip
Advertisement And it's hard to imagine them voting to trample local local enforcement. Get The Gavel A weekly SCOTUS explainer newsletter by columnist Kimberly Atkins Stohr. Enter Email Sign Up But then this administration has been just spoiling for a confrontation — especially in Los Angeles, with presidential advisers like And the president threw gasoline on the fire. Even as more demonstrators took to the streets, Advertisement Now there is no excuse for violence on the streets of any American city — and burning Waymo robot-driven cabs is hardly a good image for those with legitimate concerns about tactics used by immigration forces. The initial demonstrations were touched off by immigration raids at a garment factory and But throughout the weekend there was also no evidence that state and local police were incapable of dealing with the situation without the unasked-for federal intervention. In fact, some These are not the LA riots of 1992 in the wake of the verdict acquitting police officers of beating a Black man, Rodney King. Some Trump has long been the master of the manufactured crisis — the kind he has repeatedly used to justify broad use of executive powers. The president had barely finished taking the oath of office, when he declared a crisis at the border, requiring an Then there was the declaration of an equally nonexistent In April, with the Advertisement But by calling out the National Guard in California, on his own initiative and under false pretenses, Trump has entered new and more dangerous territory. 'The people who are causing the problems are bad people, they are insurrectionists,' Trump The president has not yet invoked the Insurrection Act but instead is using a section of the US Code on Armed Services ( That certainly explains Trump's escalating rhetoric and that of his administration, but it is an allegation that at the end of the day would have to be proven in court. 'Federal law enforcement officers were attacked by violent radicals and illegal criminals waving foreign flags because Governor Newsom was too weak to protect the city,' White House press secretary Karoline Leavitt Those 'foreign flags' were evidence not of an 'invasion' but for many Mexican-Americans in LA, But for this administration there is no detail that can't be used to distort the truth. 'Let me be clear: There is no invasion. There is no rebellion,' Advertisement Sure, Trump has long had it in for California, threatening to But the truly horrifying thing about Trump's current move is that it could happen to each and every state in the nation — or, more likely, to each and every Democratic state, especially when truth is so irrelevant to the Trump administration and facts are so fungible. The other danger is that having normalized the deployment of troops during manufactured crises, Trump will feel empowered to use them in even more forceful or aggressive ways if and when the nation faces actual crises. California's political leaders will not be fighting this battle on behalf of the rule of law alone. It's our fight too, and it won't be the last. Editorials represent the views of the Boston Globe Editorial Board. Follow us
Yahoo
29 minutes ago
- Yahoo
What will the Army 250th birthday parade look like? Here's what we know so far
WASHINGTON - The Army's 250th birthday parade will be hosted in the nation's capital this weekend, and it's expected to bring massive crowds of people to D.C., along with heightened security. The event coincides with the 79th birthday of President Donald Trump. Army officials estimate that around 200,000 people will attend the evening event. What we know The parade will go down Constitution Avenue, from 23rd Street to 15th Street, starting at 6:30 p.m. on Saturday. Fencing is up, and this is just the start of the security measures. "We're preparing for an enormous turnout," U.S. Secret Service Special Agent In Charge Matt McCool said. While Secret Service officials say they're expecting potentially hundreds of thousands of people, that's not all — SkyFox captured video over Jessup, Md., showing tanks headed to the nation's capital as well. The military parade has been designated a National Special Security Event — similar to a presidential inauguration or state funeral. That status is reserved for events that draw large crowds and potential mass protests. It calls for an enhanced degree of high-level coordination among D.C. officials, the FBI, Capitol Police and Washington's National Guard contingent — with the Secret Service taking the lead. The Army birthday celebration had already been planned for months but earlier this spring, Trump announced his intention to transform the event into a massive military parade complete with 60-ton M1 Abrams battle tanks and Paladin self-propelled howitzers rolling through the city streets. What they're saying "I cannot emphasize enough, your safety remains our number one priority," D.C. Police Chief Pamela Smith said. Still, there are some security concerns. Just this past weekend, the day the WorldPride parade took place in D.C., police responded to a shooting and a double stabbing at Dupont Circle. Meanwhile, in Los Angeles, there's been widespread unrest and violence as thousands have been on the streets to protest federal immigration crackdowns. "We are paying attention obviously to what is happening there, and we will be ready for that if it were to occur here," Special Agent McCool said. Agent Phillip Bates of the FBI's Washington Field office, which is tasked with counterterrorism and crisis management, said there were "no credible threats" to the event at the moment. Although federal, state, and local officials said Monday that they're not expecting it, their preparations include nearly 19 miles of anti-scale fencing, 17 miles of bike racks and concrete barriers, 175 magnetometers, officers from multiple agencies and drones. "Rest assured, all drones will be owned and operated by the Secret Service or our partners. So, please do not be alarmed," McCool said. What they're saying As for whether people who live in D.C. feel safe, some said yes. "I don't have any concern about safety, you know?" Northwest D.C. resident Onur told FOX 5. But others say they have some worries. "It seems kind of odd that they put up this 10 foot security fence all around if they don't expect something to happen or some kind of unrest or something," Joe Harper, Jr., said. There are also concerns regarding traffic and potential road damage if you've got all of those tanks down here. The Source This story includes information from the Associated Press and previous FOX 5 DC reporting.
