Amazon Blocks North Korean IT Workers Amid Rising Cybersecurity Concerns

Amazon has reported blocking over 1,800 North Korean applicants from securing remote IT jobs since April 2024. This surge in applications is part of a broader trend where North Korea sends IT workers abroad to earn and launder funds, often through sophisticated means such as "laptop farms." These operations allow North Korean workers to appear as if they are based in the United States while actually operating from North Korea.

The Straits Times

According to Amazon's Chief Security Officer, Stephen Schmidt, North Korean workers typically utilize remote-controlled computers in the U.S. to apply for jobs. This method not only circumvents international sanctions but also raises significant cybersecurity concerns. Schmidt noted that the company has observed a nearly one-third increase in applications from North Koreans over the past year, with telltale signs including incorrectly formatted phone numbers and dubious academic credentials.

South China Morning PostThe Straits TimesAmazon Warns Perncious Fake North Korea IT Worker Threat Has Become Widespread

In a notable case, Amazon identified a North Korean imposter working as a remote systems administrator after noticing unusual keystroke lag—110 milliseconds instead of the expected lower delay for a U.S.-based employee. This anomaly prompted further investigation, revealing that the individual was operating from North Korea, despite being registered as a local hire.

Keystroke lag alerts Amazon security staff that recent US-based IT hire was actually in North Korea

The U.S. Department of Justice has been actively pursuing cases related to this issue. An Arizona woman, Christina Marie Chapman, was sentenced to over eight years in prison for running a laptop farm that facilitated remote work for North Korean IT workers, generating more than $17 million in illicit revenue. Such schemes not only provide financial support to the North Korean regime but also pose risks to sensitive data and national security.

The Straits Times

Schmidt warned that the problem extends beyond Amazon, indicating that other companies are likely facing similar challenges. He emphasized the need for organizations to enhance their hiring processes, particularly for remote positions. This includes requiring in-person interviews and thorough background checks to detect potential impostors.

Amazon Warns Perncious Fake North Korea IT Worker Threat Has Become Widespread

Despite the growing awareness of this issue, some cybersecurity experts argue that many organizations remain ill-prepared to handle such sophisticated infiltration attempts. The reliance on traditional hiring practices may leave companies vulnerable to these deceptive tactics, necessitating a reevaluation of how remote workers are vetted.

Amazon Warns Perncious Fake North Korea IT Worker Threat Has Become Widespread

• “If we hadn’t been looking for the DPRK workers, we would not have found them.” — Stephen Schmidt, Chief Security Officer, Amazon

Keystroke lag alerts Amazon security staff that recent US-based IT hire was actually in North Korea

• “And he warned the problem “isn’t Amazon-specific” and “is likely happening at scale across the industry”.” — Stephen Schmidt, Chief Security Officer, Amazon

The Straits Times

As remote work continues to expand, the challenges posed by North Korean IT workers attempting to infiltrate U.S. companies will likely increase. Organizations must adapt their hiring practices and cybersecurity measures to mitigate these risks effectively. The ongoing vigilance and proactive measures taken by companies like Amazon serve as a critical response to this emerging threat.

Amazon Warns Perncious Fake North Korea IT Worker Threat Has Become Widespread