Ukrainian Oleksandr Didenko Sentenced to 5 Years for Supplying North Koreans with Stolen US Identities

A Ukrainian man received five years in federal prison for selling stolen American identities to North Korean IT workers. Kyiv resident Oleksandr Didenko, 39, pleaded guilty in November 2025 to aggravated identity theft and wire fraud conspiracy. Arrested in Poland in May 2024, he now faces 60 months imprisonment, 12 months supervised release, and $1.4 million forfeiture in cash and cryptocurrency.

Didenko operated UpWorkSell, an online marketplace seized by the Justice Department. He supplied 871 proxy identities and fake freelance accounts to North Korean operatives. These enabled access to 40 U.S. companies in California and Pennsylvania. Laptop farms in seven countries masked DPRK workers’ locations as American.

FBI Assistant Director James Barnacle called the scheme a backdoor into U.S. job markets funding an adversary regime. Didenko facilitated eight laptop farms across Virginia, Tennessee, California, Florida, Ecuador, Poland, and Ukraine. Arizona resident Christina Marie Chapman ran one from her home, earning 102 months prison after her July 2025 guilty plea.

Scheme Infrastructure Table

Component	Details	Locations
Proxy Identities	871 stolen U.S. identities	Sold via UpWorkSell
Freelance Accounts	3 platforms (Upwork, etc.)	Created for DPRK workers
Laptop Farms	8 physical locations	VA, TN, CA, FL, Ecuador, Poland, Ukraine
Target Companies	40 U.S. firms	California, Pennsylvania

North Korea earned millions in salaries.

North Korean IT Worker Ecosystem

DPRK runs sophisticated operations:

• State-sponsored IT worker army targets remote jobs.
• Stolen identities bypass background checks.
• Salaries fund weapons programs.
• Laptop farms simulate U.S. presence.
• Targets: Fortune 500, tech firms, government contractors.

FBI warns since 2023.

Key Enablers Convicted

Co-conspirators faced justice:

• Christina Marie Chapman: 102 months for Arizona laptop farm.
• Oleksandr Didenko: 60 months for identity marketplace.

Multiple enforcement waves hit networks.

UpWorkSell Marketplace

Didenko’s platform offered:

• U.S. PII packages with SSNs, DOBs.
• Pre-configured freelance profiles.
• VPN and proxy credentials.
• Laptop farm rental services.

DOJ seizure ended operations.

U.S. Government Response Timeline

Date	Action
2023	FBI issues first IT worker warnings
May 2024	Didenko arrested in Poland
Jul 2024	3 enforcement waves, 20 charged
Nov 2025	Didenko guilty plea
Feb 2026	60-month sentence, $1.4M forfeiture

Four sanction waves total.

Laptop Farm Mechanics

Physical setups fooled hiring managers:

• Residential U.S. IP addresses via Comcast/Verizon.
• Local phone numbers for verification calls.
• Webcam feeds during interviews.
• Timezone-compliant work hours.

DPRK workers operated remotely.

Detection Red Flags

Hiring managers watch for:

• Freelancers requesting laptop farms.
• Multiple identities from UpWorkSell domains.
• IP geolocation mismatches during interviews.
• Perfect English with cultural disconnects.

Verify physical work locations.

FBI Prevention Guidance

Protect against DPRK IT workers:

• Conduct in-person interviews when possible.
• Cross-check IP addresses against stated locations.
• Require video verification of work environments.
• Screen for UpWorkSell domain associations.
• Monitor for sudden timezone work patterns.

Report suspicious activity to IC3.gov.

Strategic Implications

North Korea adapts quickly:

• AI-generated deepfake interviews emerging.
• Russian/Chinese facilitators sanctioned.
• Famous Chollima (Lazarus) runs parallel schemes.
• Fortune 500 companies infiltrated.

Threat continues evolving.

FAQ