ROME — Pope Leo XIV demanded a ceasefire in the Middle East on Sunday in his strongest comments to date, directly addressing the leaders who launched the war in Iran.

“On behalf of the Christians of the Middle East and all women and men of good will, I appeal to those responsible for this conflict,” Leo said. “Cease fire so that avenues for dialogue may be reopened. Violence can never lead to the justice, stability, and peace that the people are waiting for.”

Leo didn’t cite the United States or Israel by name in his comments at the end of his Sunday noon blessing. But history’s first U.S. pope mentioned the attacks that targeted a school, an apparent reference to the missile strike on an elementary school in Iran in the opening days of the war that killed over 165 people, many of them children.

U.S. officials have said outdated intelligence likely led to the United States launching the strike, and that an investigation is ongoing.

The Vatican has highlighted the carnage of the Minab strike, running an aerial photo of the mass grave being dug for the young victims on the March 6 front page of its official newspaper, L’Osservatore Romano, under the headline “The Face of War.”

Leo said he was close to the families of those who had been killed in the attacks “which have hit schools, hospitals and residential centers.” He expressed particular concern about the impact of the war in Lebanon, where aid groups are warning of a humanitarian crisis.

The plight of Christian communities in southern Lebanon is of particular concern to the Vatican, since they have long represented a bulwark for Christians throughout the majority Muslim region.

For the two weeks since the start of the U.S.-Israeli war, the pope has limited his comments to muted appeals for diplomacy and dialogue in an apparent attempt to avoid pitting himself as an American political counterweight to President Donald Trump. He hasn’t named the U.S. or Israel publicly, but that is also in keeping with the Vatican’s tradition of diplomatic neutrality.

On Friday, for example, in a speech to priests attending a Vatican class on the sacrament of confession, Leo said the sacrament was a workshop that restores unity and peace.

“One might well ask: do those Christians who bear grave responsibility in armed conflicts have the humility and courage to make a serious examination of conscience and to go to confession?” he said.

But while Leo has sought to keep his messaging indirect and apolitical to avoid inflaming tensions, some of his U.S. cardinals and the Vatican secretary of state have not.

Cardinal Robert McElroy, the archbishop of Washington, said the war was morally unjustifiable. Chicago Cardinal Blase Cupich said it was “sickening” how the White House was splicing video game imagery into its social media messaging about the war.

The Vatican secretary of state, Cardinal Pietro Parolin, rejected Washington’s claim of a “preventive war.” But he said this week that the Holy See was regardless keeping dialogue open.

“The Holy See speaks with everyone, and when necessary we speak also with the Americans, with the Israelis and show them what to us are the solutions,” he said.

___

Associated Press religion coverage receives support through the AP’s collaboration with The Conversation US, with funding from Lilly Endowment Inc. The AP is solely responsible for this content.

FBI officials say laptop farms are a crucial way North Korean IT teams trick U.S. companies into believing their remote workers are in the U.S. — providing both a physical address to mail laptops to and a U.S. internet connection. Once equipped with certain remote access software and tools, workers can log into those laptops remotely.

So far, at least 10 alleged U.S.-based facilitators have been federally charged, including one active-duty member of the U.S. Army, for their alleged roles in hosting laptop farms, laundering payments and moving proceeds through shell companies. At least six other alleged U.S. facilitators have been identified in court documents but not named.

In one instance, an American citizen, Kejia “Tony” Wang, traveled to China in 2023 to meet with co-conspirators and IT workers in Shenyang and Dandong, according to court documents. Laptops from over 100 U.S. companies, including a California-based defense contractor, were sent to Wang, who also set up shell companies to help route wages earned overseas. Wang pleaded guilty to charges related to wire fraud, money laundering and identity theft and is awaiting sentencing next month.

“We believe there are many more hundreds of people out there who are participating in these schemes,” said Rozhavsky, the FBI assistant director. “They could never pull this off if they didn’t have willing facilitators in the U.S. helping them.”

Once illicit money has been earned, it needs to be consolidated and converted to government-issued currency. North Korean teams typically rely on a maze of Chinese networks to launder it, according to industry reports.

“Every bad guy you can think of is using Chinese money launderers. Now, this is how money moves internationally,” said Nick Carlsen, senior investigator on the global investigations team at the blockchain analytics company TRM Labs and a former intelligence analyst at the FBI focused on North Korea.

Since Kim Jong Un took power in 2011, North Korea has honed and expanded a portfolio of cybercrime operations beyond IT work — pulling in billions through cryptocurrency thefts including a record $1.5 billion heist last year, according to the FBI. Analysts say these operations have made Kim wealthier and more geopolitically relevant than ever before, validating his long-held view of cyberoperations as an “all-purpose sword.”

In recent years, North Korea’s partnership with Chinese money laundering networks has unlocked a new level of speed and efficiency that North Korean operators had not been able to achieve independently.

“The transformative element is the existence of these superliquid Chinese financial networks,” Carlsen said. “They can absorb a lot of money, convert it and transfer it in whatever domestic currency you want. That’s the big change.”

Most of these intermediaries operate across southern China and Southeast Asia including Myanmar, Hong Kong, Macao and China’s Fujian province — rapidly moving cryptocurrency across blockchains using so-called “mixers” that break stolen funds into smaller pieces to obscure their origin. IT worker proceeds are typically smaller sums and involve fewer intermediaries, said Andrew Fierman, head of national security intelligence at the blockchain tracking company Chainalysis, while the larger crypto heist sums require complex, multilayered laundering chains.

Carlsen noted that funds from both IT worker schemes and crypto heists frequently end up with Chinese brokers tied to organized-crime syndicates. “You see overlaps with pig-butchering scams and with drug cartels,” he said. “These are the same networks absorbing this money.” Cryptocurrencies have made that convergence easier. “It’s the lubricant,” he added. “The oil that allows all these gears to interact with each other.”

The U.S. government has taken some steps to address North Korea’s IT worker scheme, but experts warn the threat is intensifying as workers’ use of AI continues to scale up around the globe.

Cybersecurity analysts say U.S. enforcement tools are struggling to keep pace with the scale and sophistication of Pyongyang’s cyberoperations. Many of the individuals involved operate from countries that lack extradition agreements with the U.S., placing them largely beyond the reach of U.S. law enforcement.

“It’s a whack-a-mole game. It’s virtually impossible to fully disrupt this,” Carlsen said. “It’s just a never-ending process.”

He argues the most effective strategy is to make schemes less profitable by cutting off the regime’s ability to cash out through money laundering organizations.

The U.S. government has ramped up efforts to do that. On Thursday, the Treasury Department sanctioned six individuals and two entities for their roles in DPRK government-orchestrated IT worker schemes, including facilitators based in North Korea, Vietnam, Laos and Spain.

Last fall, federal authorities announced a wave of criminal indictments, forfeitures, sanctions and asset freezes targeting North Korea’s illicit cyber activity.

In October, the Treasury Department severed Cambodia-based Huione Group, a financial-guarantee network, from the U.S. financial system, alleging it laundered billions in illicit proceeds, including at least $37 million in cryptocurrency linked to North Korean operations. Weeks later, eight individuals and two entities, including North Korean bankers and institutions, were sanctioned for laundering funds derived from cybercrime and IT worker fraud schemes.

North Korea, for its part, has denied any wrongdoing.

Last year, following the Department of Justice’s indictment of several North Koreans for their alleged roles in the scheme, the country’s foreign minister condemned U.S. actions as “an absurd smear campaign” targeting the “non-existent ‘cyber threat’ from the DPRK,” the Korean Central News Agency reported.

In response to questions about Chinese nationals’ involvement in the scheme, Chinese Embassy spokesperson Liu Pengyu said, “We oppose false allegations and smears which have no factual ground at all.”

The scheme itself is also becoming more complex. North Korean IT teams are now subcontracting work to developers in Pakistan, Nigeria and India, expanding into fields like customer service, financial processing, insurance and translation services — roles far less scrutinized than software development.

“Unless you have external information, you might not know they’re North Korean,” said Michael Barnhart, who leads nation-state threat intelligence at DTEX. “They’re trying to move themselves into middle management, and it’s working.”

That expansion also means concerns that North Korean workers could cause real-world harm by jeopardizing lives, something Barnhart has seen up close.

In 2021, as part of a wave of attacks on NASA and military bases, a North Korean hacking team infected a Kansas hospital’s computer systems with ransomware, crippling servers and demanding roughly $100,000 in bitcoin to restore their function. The hospital paid. Barnhart helped investigate the hack alongside the FBI, and it was that case that made clear to him the ways in which North Korea’s malicious hacking teams sometimes cooperate with IT teams to support their missions, something that was not widely known at the time.

What he saw was a hacking operator engaged in IT work, including placing other IT workers in jobs. The income from those jobs supported the hacking unit’s primary malware operations to commit computer intrusions against U.S., South Korean and Chinese government or technology victims.

“It started off as revenue generation, but the lines are getting blurrier and blurrier. If the time comes, they’ve got chess pieces inside organizations all over the world — and they’ll start acting from the inside,” he said.

Rozhavsky expressed similar concerns.

“Even if a company gets rid of them, we don’t know what backdoors they could have left for access in the future,” he said. “So it’s definitely a ticking time bomb that could have negative consequences down the line.”

Lawmakers are also seeking stronger defenses. Sens. Gary Peters, D-Mich., and Mike Rounds, R-S.D., introduced the Protecting America from Cyber Threats Act, which would renew key cybersecurity authorities for another decade and encourage private companies, like Nisos, to share information about cyberthreats with the federal government.

Still, thousands of workers, the driving force of the IT schemes, remain out of reach, the majority of whom are based in China.

“These are the smartest people in North Korea. That’s kind of the tragedy of it,” Carlsen said. “They’ve taken their best and brightest and made them criminals.”