A U.S. federal court has sentenced Oleksandr Didenko, a 29-year-old resident of Kyiv, to five years in prison for his role in a long-running identity theft operation that helped North Korean workers gain fraudulent employment at dozens of U.S. companies.

Prosecutors allege that Didenko ran a website called Upworksell, which enabled overseas workers, including North Koreans, to purchase or rent stolen U.S. identities to secure jobs. The earnings from these jobs were funneled back to Pyongyang, reportedly to fund North Korea’s sanctioned nuclear weapons program. According to the U.S. Department of Justice, Didenko handled over 870 stolen identities.

The scheme also involved so-called “laptop farms” in California, Tennessee, and Virginia. These facilities consisted of racks of laptops hosted at private homes, allowing North Koreans to work remotely as if they were physically present in the United States.

The FBI seized Upworksell in 2024, redirecting its traffic to its own servers. Didenko was arrested in Poland, extradited to the U.S., and later pleaded guilty.

Security experts have warned of a broader pattern in which North Korean workers pose a “triple threat” to Western companies: violating U.S. sanctions, stealing sensitive corporate data, and extorting firms to prevent disclosure of breaches. CrowdStrike reported a sharp increase in North Korean workers infiltrating companies in technical roles, often as software engineers or remote developers.

Additionally, North Koreans have been known to impersonate recruiters or venture capitalists to gain access to computers and cryptocurrency holdings of high-profile and high-net-worth individuals.

This conviction is the latest in a series of cases aimed at disrupting the North Korean regime’s use of cyber-enabled labor to circumvent international sanctions and fund its illicit programs.