Loading story…
Amazon has identified and blocked over 1,800 suspected North Korean operatives attempting to secure remote IT jobs within the company since April 2024. These individuals, often using fake or stolen identities and leveraging AI tools or deepfakes, seek employment to funnel wages back to the North Korean regime, which uses the funds to support weapons programs. The company has observed a 27% quarter-over-quarter increase in such applications, highlighting the growing scale and sophistication of these operations. In one notable case, a North Korean imposter working as a sysadmin was detected due to a suspicious 110ms keystroke input lag, which raised red flags about the worker's true location.
The U.S. government and security researchers warn that this tactic is widespread, with most Fortune 500 companies believed to have been targeted or infiltrated, resulting in tens of millions of dollars in losses. Beyond financial gain, some North Korean operatives have used their access to steal proprietary data and extort employers. Additionally, DPRK-linked threat actors have developed advanced malware, such as a new variant of BeaverTail, to further support their cyber operations. Amazon's proactive detection and response efforts underscore the ongoing threat posed by North Korean state-sponsored cyber actors to major Western technology firms.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Amazon Chief Security Officer Stephen Schmidt said the company had blocked more than 1,800 suspected North Korean-linked applicants since April 2024. He also said the volume of such attempts had risen 27% quarter over quarter, underscoring a growing industry-wide threat.
Amazon uncovered a North Korean operative working through a contractor after security staff noticed keystroke input lag of more than 110 milliseconds, inconsistent with a U.S.-based remote worker. Investigation showed the employee laptop in Arizona was being remotely controlled from abroad.
U.S. law enforcement pursued a case against Arizona woman Christina Marie Chapman for helping North Korean operatives obtain remote jobs by hosting and managing dozens of company laptops in the United States. Reports say she was later sentenced to about eight and a half years in prison for her role in a fraud ring tied to roughly $1.7 million.
Amazon said it has been detecting and blocking suspected North Korean-linked job applications since April 2024, marking the start of a sustained campaign targeting the company’s hiring pipeline.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
9 references tracked. Mallory keeps watching after this page renders.
cio.com
Open sourcedarkreading.com
Open sourcecsoonline.com
Open sourcetomshardware.com
Open sourcesecurityonline.info
Open sourcecybersecuritynews.com
Open sourcehackread.com
Open sourcego.theregister.com
Open sourcetomshardware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Amazon has detected and prevented over 1,800 suspected North Korean operatives from infiltrating its workforce by posing as remote IT workers. The company’s Chief Security Officer, Stephen Schmidt, revealed that one operative was caught after investigators noticed unusual keystroke delays inconsistent with a US-based employee, leading to the discovery that the individual was operating from North Korea. This detection was part of a broader effort by Amazon to scrutinize remote work applications and identify fraudulent activity linked to the Democratic People’s Republic of Korea (DPRK). The scheme highlights ongoing attempts by North Korean actors to bypass international sanctions and generate revenue through illicit employment in Western technology companies. Amazon’s security team has reported a 27% increase in DPRK-affiliated job applications quarter over quarter in 2025, underscoring the scale and persistence of the threat. The company’s actions demonstrate the importance of behavioral analysis and vigilance in remote hiring processes to counter sophisticated nation-state tactics targeting the tech sector.
Jun 29, 2026
North Korean IT workers have significantly expanded their operations to infiltrate a wide range of industries beyond the traditional technology sector, according to research published by Okta Threat Intelligence. The scheme involves North Korean nationals, or individuals funneling money back to Pyongyang, fraudulently obtaining remote employment, primarily in software development roles. Okta's research indicates that nearly half of the targeted companies are outside the IT sector, with finance, healthcare, public administration, and professional services now among the most affected industries. The campaign, which initially focused on U.S.-based cryptocurrency and blockchain firms, has evolved to target organizations in dozens of countries, with 27% of targeted entities now located outside the United States. Okta tracked more than 130 identities associated with North Korean facilitators and workers, linking them to over 6,500 initial job interviews at more than 5,000 companies from 2021 through mid-2025. The methodology for identifying these DPRK-aligned identities relies on a combination of technical indicators, behavioral patterns, and employer reporting, though Okta has withheld some details to avoid alerting the threat actors. The scale of the operation is believed to be much larger than the tracked sample, with the FBI and private security firms, including Google's Mandiant, warning that the problem is widespread among Fortune 500 companies. Mandiant's CTO, Charles Carmakal, noted that almost every CISO of a Fortune 500 company he has spoken to has encountered issues with North Korean IT workers. The North Korean operatives use fake or stolen identities to secure remote roles, circumventing international sanctions and generating millions of dollars for the North Korean military. The campaign's adaptability is evident in its shift to any remote role that fits the scheme's requirements, regardless of industry or geography. Okta's findings highlight the persistent and evolving nature of the threat, with North Korean IT workers now targeting a broad spectrum of organizations globally. The report underscores the need for enhanced identity verification and vigilance in remote hiring processes. The expansion of this scheme poses significant risks to sensitive data, intellectual property, and the integrity of critical sectors such as healthcare and finance. The threat is compounded by the difficulty in detecting these operatives, given their use of sophisticated identity obfuscation techniques. Okta's research suggests that the true scale of North Korean IT worker activity is likely much greater than currently documented. The ongoing campaign demonstrates North Korea's commitment to leveraging cyber-enabled means to generate revenue and evade international restrictions. Organizations are urged to review their remote hiring practices and strengthen controls to mitigate the risk of inadvertently employing North Korean operatives. The findings also highlight the importance of cross-sector collaboration and intelligence sharing to counter this persistent threat. The expansion of North Korean IT worker infiltration represents a significant evolution in state-sponsored cyber-enabled financial operations.
Aug 14, 2026
Recorded Future's Insikt Group reported that a North Korean operation it tracks as **PurpleDelta** has used fake identities to pursue remote IT jobs at more than 1,100 companies, primarily targeting North American firms. Active since late 2024 and allegedly operating mainly from Shenyang, China, the cluster used at least 22 fabricated personas, AI-generated profile photos, forged identity documents, and recruitment infrastructure including `minicursor.com` and `trustidcard.com` to move through hiring pipelines. Investigators said the operators relied on transcription, screen recording, remote access, translation, and collaboration tools during interviews and after hiring, while in-country facilitators maintained company-issued laptops and other devices tied to victim organizations. The activity has been described as a new form of insider threat in which access is obtained during recruitment rather than abused after legitimate employment begins. SC Media reported that the FBI is investigating a North Korean remote IT worker employed by a U.S. federal agency, while broader estimates cited from the U.N. say such schemes have embedded operatives in hundreds of private-sector companies and generate **$250 million to $600 million annually**. The campaigns reportedly use stolen identities, deepfakes, VPN-masked locations, and U.S.-based laptop farms to secure remote roles and, in some cases, exfiltrate sensitive data, exposing gaps in conventional background checks and insider-threat programs.
Aug 25, 2026