Nashville Man Arrested for Supporting North Korea’s Illicit Weapons Program Through Cyber Scheme

Nashville, TN – Matthew Isaac Knoot, a 38-year-old resident of Nashville, Tennessee, was arrested today for his role in a scheme to generate revenue for North Korea’s illicit weapons program, including weapons of mass destruction (WMD). Knoot is accused of helping North Korean IT workers fraudulently secure remote employment with American and British companies, which funneled money into North Korea’s WMD initiatives.

The FBI, along with the Departments of State and Treasury, previously issued advisories in May 2022, October 2023, and May 2024 to warn the international community and private sector about the threat posed by North Korean IT workers. These workers often pose as freelance IT professionals using stolen identities and U.S.-based laptop farms to deceive employers and evade international sanctions.

According to court documents, Knoot participated in a complex scheme to help North Korean nationals obtain remote IT jobs by using a stolen identity to pose as a U.S. citizen. Knoot allegedly hosted company-provided laptops at his Nashville residences, installed unauthorized software, and facilitated remote access for the North Korean workers. He also conspired to launder payments for the IT work, channeling funds to accounts linked to North Korean and Chinese actors.

Assistant Attorney General Matthew G. Olsen of the Justice Department’s National Security Division commented on the case, stating, “This defendant facilitated a scheme to deceive U.S. companies into hiring foreign remote IT workers who were paid hundreds of thousands of dollars in income funneled to the DPRK for its weapons program.” U.S. Attorney Henry C. Leventis for the Middle District of Tennessee added, “Today’s indictment is the most recent example of our office’s commitment to protecting the United States’ national security interests.”

Knoot is charged with multiple offenses, including conspiracy to cause damage to protected computers, conspiracy to launder monetary instruments, conspiracy to commit wire fraud, intentional damage to protected computers, aggravated identity theft, and conspiracy to cause the unlawful employment of aliens. If convicted, he faces up to 20 years in prison, with a mandatory minimum of two years for the aggravated identity theft charge.

This case is part of the Department-wide “DPRK RevGen: Domestic Enabler Initiative,” launched in March 2024 by the National Security Division and the FBI’s Cyber and Counterintelligence Divisions. The initiative targets U.S.-based “laptop farms” and other activities that enable North Korean cyber schemes.

The FBI is leading the investigation, and the case is being prosecuted by Assistant U.S. Attorney Josh Kurtzman for the Middle District of Tennessee and Trial Attorney Greg Nicosia of the National Security Division’s Cyber Section.

Note: An indictment is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Code on monitorPhoto byAlberlan Barros