达斯汀·沃尔茨 FBI 在 9 月份破坏了一个利用美国协助者和笔记本电脑农场为平壤核武器和弹道导弹项目提供资金的朝鲜 IT 工作网络。
Dustin Volz The FBI disrupted a North Korean IT job network that used US facilitators and laptop farms to fund Pyongyang’s nuclear and ballistic weapons programmes.
美国官员表示，在德克萨斯州拆除了超过 40 个笔记本电脑农场，查获了近 200 台设备，并对 12 名嫌疑人解封了涉及 300 万美元诈骗的起诉书。
US officials said more than 40 laptop farms were dismantled in Texas, nearly 200 devices were seized, and indictments were unsealed against 12 suspects over a US$3 million fraud.
该计划利用被盗身份、AI 工具和西方同伙欺骗美国公司，FBI 警告称该威胁正在增长且极其严重。
The scheme used stolen identities, AI tools and Western accomplices to trick US firms, and the FBI warned the threat is growing and highly serious.
AI 生成 华盛顿 — 美国官员于 10 月 13 日表示，FBI 在 9 月份破坏了一个广泛的美国协助者网络，这些人被指控帮助朝鲜政府获得远程信息技术工作，这些工作有助于为这个封闭国家的核武器和弹道导弹项目提供资金。
AI generated WASHINGTON – The FBI in September disrupted a widespread network of American facilitators accused of aiding the North Korean government in securing remote information technology jobs that helped fund the reclusive country’s nuclear and ballistic weapons programmes, US officials said Oct 13.
此次行动包括在德克萨斯州拆除超过 40 个所谓的笔记本电脑农场，并查获近 200 台计算机设备，官员表示，这是美国当局迄今为止规模最大的行动之一，旨在切断朝鲜用于规避严厉国际制裁并近年来创造数十亿美元现金的关键收入来源。
The operation included the dismantling of more than 40 so-called laptop farms across Texas and the seizure of nearly 200 computer devices, the officials said, marking one of the largest efforts to date by the US authorities to block a key revenue stream that has helped North Korea evade harsh international sanctions and generate billions in cash in recent years.
司法部另行于 10 月 13 日在俄亥俄州解封了起诉书，指控两名美国公民和十名在中国的朝鲜人利用身份盗窃从不知情的美国公司那里获取工资。
The Justice Department separately unsealed indictments in Ohio on Oct 13 against two US nationals and 10 China-based North Koreans accused of committing identity theft to earn pay cheques from unwitting US companies that hired them.
检察官称，该计划诈骗了 70 家公司，金额超过 300 万美元（约 384 万新元），时间从 2019 年持续到 2025 年。另外两名被告的身份仍被保密。
Prosecutors said that scheme bilked 70 companies out of more than US$3 million (S$3.84 million) and ran from 2019 to 2025. The identities of two additional defendants remained under seal.
这些行动是美国在加强遏制朝鲜数字威胁的行动中的最新举措，这种威胁具有隐蔽性和演变性，其规模尚不明确但可能非常庞大。
The moves were the latest by the United States in an intensifying campaign to try to cut off a stealthy and evolving digital threat from North Korea whose scale is not entirely clear but likely vast.
拜登政府和第二届特朗普政府的美国情报官员表示，IT 工作骗局是为平壤武器计划提供资金的主要手段之一，另一个主要手段是加密货币盗窃。
US intelligence officials in the Biden and second Trump administrations have said the IT worker scams are a primary method of funding Pyongyang’s weapons programme, alongside thefts of cryptocurrency.
北朝鲜正在部署“数千名受国家控制的IT工人，渗透进入美国及其盟国的公司”，美国联邦调查局网络部门负责人布雷特·利瑟曼在接受采访时表示。
North Korea is deploying “thousands of state-controlled IT workers to infiltrate companies in the United States and allied countries”, Brett Leatherman, the head of the FBI’s cyber division, said in an interview.
“这些工作中的每一个都在为一个核弹和弹道导弹计划提供资金来源，该计划是通过窃取美国人的身份并获得美国雇主的信任而得以实现的。”利瑟曼说，联邦调查局与总部位于美国的网络安全公司CrowdStrike密切合作，以识别和破坏该网络。
“Every one of these jobs is funding a stream for a nuclear and ballistic missiles programme obtained with the stolen identity of an American and the trust of an American employer.”The bureau worked closely with the US-based cybersecurity firm CrowdStrike to identify and disrupt the network, Leatherman said.
他补充说，这些协调行动是联邦调查局新网络战略的早期例子，该战略于9月份公布，承诺加强与私营部门的合作，以阻碍或挫败恶意活动的方式打击黑客。
He added that the coordinated actions were an early example of the FBI’s new cyber strategy, which was unveiled in September and promised closer collaboration with the private sector to target hackers in ways that impede or thwart malicious activity.
该战略是特朗普政府更广泛努力的一部分，旨在更紧密地与美国公司合作，通过网络攻击打击黑客，这一转变得到了一些安全专家的谨慎欢迎。
The strategy is part of a broader effort across the Trump administration to work more closely with US companies to strike hackers with cyberattacks, a pivot cautiously welcomed by some security experts.
美国官员和网络安全分析人士表示，朝鲜的IT工人计划是当今企业面临的最严重的持续性数字威胁之一，且这一风险仍被低估。
US officials and cybersecurity analysts have said the North Korean IT worker scheme is among the most serious ongoing digital threats facing businesses today and that it remains underappreciated as a risk.
CrowdStrike负责对抗对手行动的亚当·迈尔斯表示，朝鲜通过获取工作岗位的计划“在普遍性和复杂性方面都在增加”。
Adam Meyers, who oversees counteradversary operations at CrowdStrike, said the North Korean schemes to get hired for jobs have been “increasing both in prevalence and complexity”.
迈尔斯说，很难知道美国笔记本电脑农场有多普遍，但他指出，CrowdStrike在9月份期间每天平均识别出两起新案例——这可能只是冰山一角。
It is difficult to know how widespread laptop farms are in the United States, Meyers said, but noted that CrowdStrike identified an average of two new cases per day throughout September – which is likely only the tip of the iceberg.
超过两年来，美国情报官员和网络安全研究人员一直警告称，朝鲜一直在使用被盗的美国身份——这些身份通常是从被泄露的私人信息中获得的，比如社保号码，在暗网上获取——以及人工智能工具，以在美国、欧洲及其他地区的公司中获得远程IT岗位。
For more than two years, US intelligence officials and cybersecurity researchers have warned that North Korea has been using stolen American identities – often acquired from compromised private information, like Social Security numbers, on the dark web – and artificial intelligence tools to get hired for remote IT jobs at companies across the United States, Europe and elsewhere.
专家表示，从小型初创公司到财富500强企业的各类公司都已成为受害者。
Experts have said companies ranging from small start-ups to Fortune 500 firms have been victimised.
根据调查人员的说法，该诈骗行动的一个关键方面是来自美国的支持者，他们被朝鲜招募，以帮助绕过企业安全措施以检测欺诈性雇佣。
A crucial aspect of the fraud campaign is support from people in the United States who are recruited by North Korea to help bypass corporate security measures that detect fraudulent hires, according to investigators.
协助者通过在看似合法住所的地址接收和设置工作笔记本电脑，从而帮助实施诈骗，这些地址对企业人力资源团队而言似乎是合法住所。
Facilitators help enable the fraud by receiving and setting up work laptops at addresses that appear like legitimate residences to corporate human resources teams.
随后，朝鲜操作人员使用软件远程隧道进入这些笔记本电脑并在其上工作，向雇佣他们的公司冒充美国人。
North Korean operators then use software to remotely tunnel into those laptops and work on them, posing as Americans to the companies that hired them.
协助者的吸引力很简单：看似轻松赚钱的工作，而且至少起初可能对他们要求不多。“他们一开始就会对这种事情上瘾，然后对他们的要求会越来越多，到了那时他们就会陷得太深了，”迈尔斯说。
The appeal for facilitators is simple: Jobs that look like easy cash and, at least at first, might not require much of them. “They get kind of hooked on it initially, and then more gets asked of them, and they’re kind of in too deep at that point,” Meyers said.
利瑟曼表示，德州的扫荡行动并未包括对协助者的任何逮捕，但当局警告他们，如果继续协助远程诈骗，他们可能会面临刑事处罚。
Leatherman said that the Texas sweep did not include any arrests of facilitators but that the authorities warned them they could face criminal penalties should they continue to assist with remote fraud.
他表示，这一决定部分源于希望快速行动以颠覆该网络，而不是等待检察官提起诉讼。
The decision stemmed in part from a desire to move quickly to upend the network rather than wait for prosecutors to file charges, he said.
利瑟曼说，这些笔记本电脑农场通常对朝鲜人来说就像一个“微型数据中心”，其中一名协助者会托管数十甚至上百台用于填补数十个职位的笔记本电脑。
Leatherman said the laptop farms often operate like a “mini data centre” for the North Koreans, where one facilitator hosts dozens or even hundreds of laptops used to fill scores of jobs.
一名亚利桑那州的妇女在2025年被判处超过八年监禁，被指控在其住所托管数十台笔记本电脑，以帮助朝鲜人连接到超过300家美国公司。朝鲜的IT工人军队的战术一直在稳步演变以逃避检测。
A woman in Arizona sentenced in 2025 to more than eight years in prison was accused of hosting dozens of laptops at her home to help North Koreans connect to more than 300 US companies. The tactics of North Korea’s IT worker army have steadily evolved to evade detection.
官员们表示，这包括增加对人工智能的依赖，以创建虚假简历、视频和照片，并导航虚拟工作面试。
That includes increased reliance on artificial intelligence to create fake resumes, videos and photos, and to navigate virtual job interviews, officials said.
勒瑟曼表示，诈骗者也越来越依赖巴基斯坦和尼日利亚等地的分包商，以进一步掩盖朝鲜的参与。
The fraudsters are also relying more on subcontractors in places like Pakistan and Nigeria to further obscure North Korean involvement, Leatherman said.
FBI 在 10 月 13 日发布的警告中表示，朝鲜人正在向美国人和其他西方同伙支付报酬，以“执行日益增多的身份和地点掩蔽任务”，这些任务包括出镜、参加面试或会议、核实欺诈性身份、寄送包裹，甚至完成尿检或提交指纹。 《纽约时报》 本文首发于《纽约时报》。
In an advisory released on Oct 13, the FBI said the North Koreans were paying Americans and other Western accomplices to “perform a growing variety of identity and location obfuscation tasks” that included appearing on camera, participating in job interviews or meetings, verifying fraudulent identities, shipping packages, and even completing urinalysis tests or fingerprint submissions. NYTIMES This article originally appeared in The New York Times.