Loading story…
Amazon has detected and prevented over 1,800 suspected North Korean operatives from infiltrating its workforce by posing as remote IT workers. The company’s Chief Security Officer, Stephen Schmidt, revealed that one operative was caught after investigators noticed unusual keystroke delays inconsistent with a US-based employee, leading to the discovery that the individual was operating from North Korea. This detection was part of a broader effort by Amazon to scrutinize remote work applications and identify fraudulent activity linked to the Democratic People’s Republic of Korea (DPRK).
The scheme highlights ongoing attempts by North Korean actors to bypass international sanctions and generate revenue through illicit employment in Western technology companies. Amazon’s security team has reported a 27% increase in DPRK-affiliated job applications quarter over quarter in 2025, underscoring the scale and persistence of the threat. The company’s actions demonstrate the importance of behavioral analysis and vigilance in remote hiring processes to counter sophisticated nation-state tactics targeting the tech sector.
TTPs, infrastructure, and targeting history in one profile.
12 events from the most recent confirmed update back to the earliest known activity.
Microsoft announced plans to finally disable RC4 encryption by mid-2026. The move followed years of criticism over the legacy cipher's continued availability despite repeated security concerns.
A new managed security service provider initiative was launched to help defend small U.S. water utilities. The program was introduced in response to persistent targeting of the sector by Chinese and Iranian threat actors.
The FBI, working with Estonian law enforcement, seized a phishing domain used to steal bank credentials from U.S. victims. Authorities said the operation was linked to $14.6 million in losses.
Interpol carried out an enforcement action targeting ransomware actors operating in Africa. The operation was reported as part of broader international efforts to disrupt cybercriminal groups.
The U.S. Department of Justice announced charges against suspects accused of involvement in ATM jackpotting activity. The case was one of several law-enforcement actions against financially motivated cybercrime reported that week.
Reporting indicated that data stolen in the 2022 LastPass breach is still being exploited, with password vaults being cracked and then used to steal cryptocurrency. This marked a continuing escalation in the long-term impact of the original breach.
France's La Poste suffered a cyberattack that was claimed by the Russian DDoS group NoName057. The event added to a series of disruptive attacks attributed to pro-Russian hacktivist actors.
French privacy regulator CNIL imposed fines on Mobius and Nexpublica in connection with major data breaches. The enforcement action was reported as part of the week's notable cyber developments in France.
A supply chain compromise involving EmEditor led to users receiving an infostealer through a modified installer. The incident represented a software distribution channel being abused to spread malware.
Romania's water agency ANAR was reported as suffering operational disruption following a ransomware attack. The incident was cited as a significant cyber event affecting public-sector infrastructure.
The UK's Foreign Office confirmed it was hit by a cyberattack, and reporting said the intrusion was suspected to be tied to a Chinese threat actor tracked as Storm-1849. The incident was highlighted as one of the week's major state-linked breaches.
Amazon said it detected and stopped more than 1,800 attempts by North Korean operatives to obtain jobs at the company using identity fraud and remote-work tactics. The activity was identified in part through signals such as keystroke lag.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Amazon has identified and blocked over 1,800 suspected North Korean operatives attempting to secure remote IT jobs within the company since April 2024. These individuals, often using fake or stolen identities and leveraging AI tools or deepfakes, seek employment to funnel wages back to the North Korean regime, which uses the funds to support weapons programs. The company has observed a 27% quarter-over-quarter increase in such applications, highlighting the growing scale and sophistication of these operations. In one notable case, a North Korean imposter working as a sysadmin was detected due to a suspicious 110ms keystroke input lag, which raised red flags about the worker's true location. The U.S. government and security researchers warn that this tactic is widespread, with most Fortune 500 companies believed to have been targeted or infiltrated, resulting in tens of millions of dollars in losses. Beyond financial gain, some North Korean operatives have used their access to steal proprietary data and extort employers. Additionally, DPRK-linked threat actors have developed advanced malware, such as a new variant of BeaverTail, to further support their cyber operations. Amazon's proactive detection and response efforts underscore the ongoing threat posed by North Korean state-sponsored cyber actors to major Western technology firms.
Jun 29, 2026
North Korean IT workers have significantly expanded their operations to infiltrate a wide range of industries beyond the traditional technology sector, according to research published by Okta Threat Intelligence. The scheme involves North Korean nationals, or individuals funneling money back to Pyongyang, fraudulently obtaining remote employment, primarily in software development roles. Okta's research indicates that nearly half of the targeted companies are outside the IT sector, with finance, healthcare, public administration, and professional services now among the most affected industries. The campaign, which initially focused on U.S.-based cryptocurrency and blockchain firms, has evolved to target organizations in dozens of countries, with 27% of targeted entities now located outside the United States. Okta tracked more than 130 identities associated with North Korean facilitators and workers, linking them to over 6,500 initial job interviews at more than 5,000 companies from 2021 through mid-2025. The methodology for identifying these DPRK-aligned identities relies on a combination of technical indicators, behavioral patterns, and employer reporting, though Okta has withheld some details to avoid alerting the threat actors. The scale of the operation is believed to be much larger than the tracked sample, with the FBI and private security firms, including Google's Mandiant, warning that the problem is widespread among Fortune 500 companies. Mandiant's CTO, Charles Carmakal, noted that almost every CISO of a Fortune 500 company he has spoken to has encountered issues with North Korean IT workers. The North Korean operatives use fake or stolen identities to secure remote roles, circumventing international sanctions and generating millions of dollars for the North Korean military. The campaign's adaptability is evident in its shift to any remote role that fits the scheme's requirements, regardless of industry or geography. Okta's findings highlight the persistent and evolving nature of the threat, with North Korean IT workers now targeting a broad spectrum of organizations globally. The report underscores the need for enhanced identity verification and vigilance in remote hiring processes. The expansion of this scheme poses significant risks to sensitive data, intellectual property, and the integrity of critical sectors such as healthcare and finance. The threat is compounded by the difficulty in detecting these operatives, given their use of sophisticated identity obfuscation techniques. Okta's research suggests that the true scale of North Korean IT worker activity is likely much greater than currently documented. The ongoing campaign demonstrates North Korea's commitment to leveraging cyber-enabled means to generate revenue and evade international restrictions. Organizations are urged to review their remote hiring practices and strengthen controls to mitigate the risk of inadvertently employing North Korean operatives. The findings also highlight the importance of cross-sector collaboration and intelligence sharing to counter this persistent threat. The expansion of North Korean IT worker infiltration represents a significant evolution in state-sponsored cyber-enabled financial operations.
Aug 14, 2026
Recorded Future's Insikt Group reported that a North Korean operation it tracks as **PurpleDelta** has used fake identities to pursue remote IT jobs at more than 1,100 companies, primarily targeting North American firms. Active since late 2024 and allegedly operating mainly from Shenyang, China, the cluster used at least 22 fabricated personas, AI-generated profile photos, forged identity documents, and recruitment infrastructure including `minicursor.com` and `trustidcard.com` to move through hiring pipelines. Investigators said the operators relied on transcription, screen recording, remote access, translation, and collaboration tools during interviews and after hiring, while in-country facilitators maintained company-issued laptops and other devices tied to victim organizations. The activity has been described as a new form of insider threat in which access is obtained during recruitment rather than abused after legitimate employment begins. SC Media reported that the FBI is investigating a North Korean remote IT worker employed by a U.S. federal agency, while broader estimates cited from the U.N. say such schemes have embedded operatives in hundreds of private-sector companies and generate **$250 million to $600 million annually**. The campaigns reportedly use stolen identities, deepfakes, VPN-masked locations, and U.S.-based laptop farms to secure remote roles and, in some cases, exfiltrate sensitive data, exposing gaps in conventional background checks and insider-threat programs.
Aug 25, 2026