DUSTIN VOLZ2026年10月14日美国官员称，近年来，朝鲜通过远程IT工作者项目规避了国际制裁，赚取了数十亿美元的现金。 Anthony Wallace/Agence France-Presse — Getty ImagesThe F.B.I. last month disrupted a widespread network of American facilitators accused of aiding the North Korean government in securing remote information technology jobs that helped fund the reclusive country’s nuclear and ballistic weapons programs, U.S. officials said Tuesday.美国官员周二表示，联邦调查局上个月捣毁了一个由美国人组成的广泛网络，这些人被指控帮助朝鲜政府获取远程信息技术工作岗位，从而为这个与世隔绝的国家的核武器和弹道导弹计划提供资金。The operation included the dismantling of more than 40 so-called laptop farms across Texas and the seizure of nearly 200 computer devices, the officials said, marking one of the largest efforts to date by U.S. authorities to block a key revenue stream that has helped North Korea evade harsh international sanctions and generate billions in cash in recent years.官员们表示，此次行动包括在得克萨斯州各地捣毁了40多个所谓“笔记本电脑农场”，并查获近200台计算机设备。这是美国当局迄今为止为阻断这一关键收入来源所采取的最大规模行动之一。近年来，这一收入来源帮助朝鲜规避了严厉的国际制裁，并创造了数十亿美元的现金。The Justice Department separately unsealed indictments in Ohio on Tuesday against two U.S. nationals and 10 China-based North Koreans accused of committing identity theft to earn paychecks from unwitting American companies that hired them. Prosecutors said that scheme bilked 70 companies out of more than $3 million and ran from 2019 to 2025. The identities of two additional defendants remained under seal.另外，美国司法部周二在俄亥俄州解封了针对两名美国公民和10名驻华朝鲜人的起诉书，指控他们通过盗用身份信息，从不知情的美国雇主处骗取薪资。检察官表示，该计划从2019年持续到2025年，骗取了70家公司超过300万美元。另外两名被告的身份仍处于保密状态。The moves were the latest by the United States in an intensifying campaign to try to cut off a stealthy and evolving digital threat from North Korea whose scale is not entirely clear but likely vast. U.S. intelligence officials in both the Biden and second Trump administrations have said the I.T. worker scams are a primary method of funding Pyongyang’s weapons program, alongside thefts of cryptocurrency.这些举措是美国在不断升级的行动中采取的最新手段，旨在试图切断来自朝鲜的隐秘且不断演变的数字威胁，这种威胁的规模尚不完全清楚，但可能非常庞大。拜登政府和第二届特朗普政府的美国情报官员都曾表示，IT人员诈骗与窃取加密货币一样，是为平壤武器项目提供资金的主要方式。North Korea is deploying “thousands of state-controlled I.T. workers to infiltrate companies in the United States and allied countries,” Brett Leatherman, the head of the F.B.I.’s cyber division, said in an interview. “Every one of these jobs is funding a stream for a nuclear and ballistic missiles program obtained with the stolen identity of an American and the trust of an American employer.”“朝鲜正在部署数以千计受国家控制的IT人员，渗透美国及其盟国的企业，”联邦调查局网络部门负责人布雷特·莱瑟曼在接受采访时表示。“他们利用窃取的美国人身份和美国雇主的信任获得了这些工作，而每一份这样的工作都在为核武器和弹道导弹项目提供资金来源。”The bureau worked closely with the U.S.-based cybersecurity firm CrowdStrike to identify and disrupt the network, Mr. Leatherman said. He added that the coordinated actions were an early example of the F.B.I.’s new cyber strategy, which was unveiled last month and promised closer collaboration with the private sector to target hackers in ways that impede or thwart malicious activity. The strategy is part of a broader effort across the Trump administration to work more closely with American companies to strike hackers with cyberattacks, a pivot cautiously welcomed by some security experts.莱瑟曼说，联邦调查局与总部位于美国的网络安全公司CrowdStrike密切合作，查明并捣毁了这个网络。他还说，这些协调行动是联邦调查局新网络战略的早期范例，该战略于上个月公布，承诺与私营部门加强合作，以阻碍或挫败恶意活动的方式打击黑客。该战略是特朗普政府更广泛举措的一部分，旨在与美国企业更紧密地合作，通过网络攻击打击黑客，一些安全专家对此转变表示谨慎欢迎。U.S. officials and cybersecurity analysts have said the North Korean I.T. worker scheme is among the most serious ongoing digital threats facing businesses today, and that it remains underappreciated as a risk. Adam Meyers, who oversees counteradversary operations at CrowdStrike, said the North Korean schemes to get hired for jobs have been “increasing both in prevalence and complexity.”美国官员和网络安全分析师表示，朝鲜IT人员骗局是当今企业面临的最严重的持续性数字威胁之一，但其风险仍被低估。负责CrowdStrike反制对手行动的亚当·迈耶斯表示，朝鲜获取雇佣的骗局“在普遍性和复杂性方面都在不断增加”。It is difficult to know how widespread laptop farms are in the United States, Mr. Meyers said, but noted that CrowdStrike identified an average of two new cases per day throughout the month of September — which is likely only the tip of the iceberg.迈耶斯说，目前尚难以确定笔记本电脑农场在美国的普及程度，但他指出，CrowdStrike在整个9月份平均每天发现两起新案例——而这可能只是冰山一角。For more than two years, U.S. intelligence officials and cybersecurity researchers have warned that North Korea has been using stolen American identities — often acquired from compromised private information, like Social Security numbers, on the dark web — and artificial intelligence tools to get hired for remote information technology jobs at companies across the United States, Europe and elsewhere. Experts have said companies ranging from small start-ups to Fortune 500 firms have been victimized.两年多来，美国情报官员和网络安全研究人员一直警告称，朝鲜一直在利用窃取的美国人身份——通常是从暗网上泄露的隐私信息中获取（如社会安全号码）——以及人工智能工具，在美国、欧洲及其他地方的公司获得远程信息技术工作。专家表示，从小微初创企业到财富500强公司，各类企业都已成为受害者。A crucial aspect of the fraud campaign is support from people in the United States who are recruited by North Korea to help bypass corporate security measures that detect fraudulent hires, according to investigators. Facilitators help enable the fraud by receiving and setting up work laptops at addresses that appear like legitimate residences to corporate human-resources teams. North Korean operators then use software to remotely tunnel into those laptops and work on them, posing as Americans to the companies that hired them.调查人员表示，这场欺诈活动的一个关键环节是来自美国境内人员的协助，他们被朝鲜招募，帮助绕过企业用于检测欺诈性雇佣的安全措施。协助者通过在看似合法住所的地址接收并设置工作笔记本电脑，从而为欺诈行为提供便利，使企业人力资源团队误以为这些地址是合法住所。然后，朝鲜操作员使用软件远程登录这些笔记本电脑并在其上工作，向雇佣他们的公司冒充美国人。The appeal for facilitators is simple: jobs that look like easy cash and, at least at first, might not require much of them. “They get kind of hooked on it initially, and then more gets asked of them, and they’re kind of in too deep at that point,” Mr. Meyers said.对协助者来说，诱惑很简单：这些工作看似能轻松赚钱，而且至少在最初可能不需要他们做太多事情。“他们一开始有点上瘾，然后被要求做得更多，到那个时候，他们就已经陷得太深了，”迈耶斯说。Mr. Leatherman said that the Texas sweep did not include any arrests of facilitators, but that authorities warned them they could face criminal penalties should they continue to assist with remote fraud. The decision stemmed in part from a desire to move quickly to upend the network rather than wait for prosecutors to file charges, he said.莱瑟曼说，得克萨斯州的扫荡行动中并没有逮捕任何协助者，但当局警告他们，如果继续协助远程欺诈，可能会面临刑事处罚。他说，这一决定部分源于希望迅速采取行动瓦解该网络，而不是等待检察官提起指控。Mr. Leatherman said the laptop farms often operate like a “mini data center” for the North Koreans, where one facilitator hosts dozens or even hundreds of laptops used to fill scores of jobs. A woman in Arizona sentenced last year to more than eight years in prison was accused of hosting dozens of laptops at her home to help North Koreans connect to more than 300 U.S. companies.莱瑟曼表示，这些笔记本电脑农场的运作模式往往就像一个朝鲜人的“迷你数据中心”， 一名协助者会托管数十台甚至数百台笔记本电脑，用于处理大量工作任务。去年一名女子在亚利桑那州被判处八年多监禁，她被控在其家中托管数十台笔记本电脑，帮助朝鲜人连接到300多家美国公司。The tactics of North Korea’s I.T. worker army have steadily evolved to evade detection. That includes increased reliance on artificial intelligence to create fake résumés, videos and photos, and to navigate virtual job interviews, officials said. The fraudsters are also relying more on subcontractors in places like Pakistan and Nigeria to further obscure North Korean involvement, Mr. Leatherman said.为逃避侦查，朝鲜IT工作者大军的战术在不断演变。官员们表示，这包括越来越多地依赖人工智能来伪造简历、视频和照片，以及应对虚拟求职面试。莱瑟曼说，欺诈者还日益依赖巴基斯坦和尼日利亚等地的分包商，以此进一步掩盖朝鲜的参与。In an advisory released on Tuesday, the F.B.I. said the North Koreans were paying Americans and other Western accomplices to “perform a growing variety of identity and location obfuscation tasks” that included appearing on camera, participating in job interviews or meetings, verifying fraudulent identities, shipping packages, and even completing urinalysis tests or fingerprint submissions.在周二发布的一份建议中，联邦调查局表示，朝鲜正在付钱给美国人和其他西方同谋，让他们“执行日益多样化的身份和位置混淆任务”，其中包括出境、参加求职面试或会议、验证虚假身份、寄送包裹，甚至完成尿检或指纹采集。Dustin Volz为时报撰写网络安全和情报方面的文章，他常驻华盛顿。翻译：晋其角点击查看本文英文版。