Keyboard lag unmasks North Korean spy in Amazon’s IT Department

Amazon’s security team recently uncovered a North Korean infiltrator working within its IT operations after noticing an unusual 110 millisecond delay in his keyboard input. What first appeared to be an ordinary remote work setup raised red flags when the timing of keystrokes landed outside the expected range for a U.S.-based employee. This prompted deeper investigation, eventually revealing the worker’s true origins.

Amazon’s Chief Security Officer, Stephen Schmidt, explained that the company’s systems flagged the unusually slow character transmission, a stark contrast to the typical tens of milliseconds seen from legitimate remote workers.

After tracing the connection and examining hiring data, the security team determined the operative was not where he claimed to be, but effectively controlling his assigned laptop from abroad. Further investigation unmasked the worker as a North Korean national operating under a fabricated identity.

Long running employment scam

This incident is part of a larger pattern of state-linked schemes where North Korean nationals bypass sanctions to secure remote IT positions with Western companies. They work normally, but the real reason they are there is to steal intellectual property.

Since April 2024, Amazon has reportedly blocked more than 1,800 suspected North Korean applicants from joining its workforce, with these attempts increasing by roughly 27 percent each quarter, according to internal security reports.

The U.S. citizen who facilitated the scam by hosting the laptop, a practice known as "laptop farming" was previously sentenced to several years in prison. During her arrest in February, it was revealed that the scam had channeled over $17 million back to North Korea.

Looking forward

While Amazon swiftly removed the infiltrator from its systems and reinforced its security protocols, the episode underscores a growing cybersecurity challenge as remote work expands globally. Even tiny anomalies, like a fraction of a second in typing delays, can prove decisive in detecting sophisticated deception.