The US Department of Justice has announced that five people have pleaded guilty to helping North Koreans defraud US companies by pretending to be US-based remote workers. North Korea has previously used fake identities and the direct manipulation of US cybersecurity workers to circumvent international sanctions and funnel money into the country.

In this case, the people knew they were helping North Koreans, the DOJ says, and “provided their own, false, or stolen identities” to help the remote workers get jobs. They also “hosted U.S. victim company-provided laptops at residences across the United States” to hide the workers’ location. In the case of at least two “facilitators,” they also took company drug tests on the workers’ behalf.

Audricus Phagnasay, Jason Salazar and Alexander Paul Travis each pleaded guilty to one wire fraud conspiracy for their role in the scam. Travis was paid “at least $51,397” for participating, while Phagnasay and Salazar earned “at least $3,450 and $4,500, respectively.” Another facilitator, Erick Ntekereze Prince, used his company to contract certified IT workers to other US companies, fully knowing the workers were using stolen identities. He earned “more than $89,000” for his participation in the scam and pleaded guilty to one count of wire fraud conspiracy.

The final facilitator, Oleksandr Didenko, pleaded guilty for one count of wire fraud conspiracy and one count of aggravated identity theft for participating in an extensive identity theft operation. Didenko helped foreign IT workers fraudulently gain employment at 40 US companies, the DOJ says, and he’s forfeiting $1.4 million as part of his plea.

“These prosecutions make one point clear: the United States will not permit the DPRK to bankroll its weapons programs by preying on American companies and workers,” U.S. Attorney Jason A. Reding Quiñones said in the DOJ announcement. “We will keep working with our partners across the Justice Department to uncover these schemes, recover stolen funds, and pursue every individual who enables North Korea’s operations.”