Matthew Isaac Knoot confirmed

According to court documents, Knoot ran a laptop farm from his Nashville residences between approximately July 2022 and August 2023. The victim companies shipped laptops addressed to “Andrew M.” to Knoot’s residences. Following receipt of the laptops, and without authorization, Knoot logged on to the laptops, downloaded and installed unauthorized remote desktop applications, and accessed the victim companies’ networks. The remote desktop applications enabled a North Korean IT worker to work from locations in China, while appearing to the victim companies that “Andrew M.” was working from Knoot’s residences in Nashville. On Aug. 7, 2024, Knoot was charged by indictment alleging his participation in a criminal scheme that obtained work for North Korean IT workers from at least four U.S. companies. The victim companies paid the DPRK IT workers associated with Knoot’s laptop farm more than $250,000 for their work between approximately July 2022 and August 2023. Most, if not all, of this sum was falsely reported to the IRS and Social Security Administration in the name of the actual U.S. person, Andrew M., whose identity the conspirators had stolen. Knoot’s and his conspirators’ actions also caused the victim companies more than $500,000 in costs associated with auditing and remediating their devices, systems, and networks. Knoot and the DPRK IT workers conspired to receive payments from the victim companies and transfer those funds to Knoot and to accounts outside of the United States, including accounts associated with North Korean and Chinese individuals. Knoot’s role in this scheme ended when the FBI executed a court-authorized search of his home on Aug. 8, 2023, after which Knoot made multiple false and misleading statements and destroyed evidence to obstruct the investigation.