Essentially, they steal US social security numbers or ITINs from leaked identities to apply for jobs in the US as US citizens. They then make money for prohibited countries like North Korea while pretending to be that citizen. The mony is exfiltrated through cryptocurrency or money mules. In the meantime they install malware and steal anything that isn't nailed down. Passwords, keys, proprietary documents, cryptocurrency, etc...

Edit: They also recruit US Citizens through "Work from home" schemes to help them engage in the fraud.

The majority of people in the country without documented status entered legally.

Seems like you didn't read it right.. The trouble with border security is that it is a very expensive way to get a misplaced sense of security.

> They're in the U.S. somewhere

Nope. UAE or Laos:

"The men speak English and Korean and have ties to the United Arab Emirates and Laos"