North Korean Hackers Are Trying to Infiltrate Amazon

According to Inc, Amazon’s chief security officer, Stephen Schmidt, revealed the company has blocked nearly 2,000 job applications from suspected North Korean operatives since April 2024. Schmidt, a former FBI agent, said these individuals are applying for remote IT jobs, especially in high-demand AI and machine learning roles, using stolen or fake identities. Their stated objective is to get hired, get paid, and funnel wages back to fund the DPRK regime’s weapons programs. Amazon detected a 27 percent increase in these DPRK-affiliated applications quarter-over-quarter this year. The identities being used aren’t old accounts but are often hijacked from credible software engineers, sometimes with the owners’ complicity for money.

The New Frontier of State Theft

This isn’t your granddad’s espionage. Forget guys in trench coats swapping briefcases. The modern state-sponsored theft operation looks like a LinkedIn profile and a Zoom interview. Here’s the thing: it’s brutally logical. Why risk international incidents stealing secrets when you can just get a job and have a company directly deposit a salary into an account you control? It’s a low-risk, high-reward scheme that turns Western tech salaries into a direct funding stream for ballistic missiles. And the focus on AI and machine learning roles is particularly telling. It’s not just about the money; it’s about embedding talent in the very companies defining the future of critical technology.

A Security Nightmare For Everyone

But let’s be skeptical for a second. Amazon caught these 1,800+ attempts. How many slipped through? Schmidt’s disclosure is probably meant to be a deterrent and a warning to other companies. The method—hijacking real engineers’ accounts—is a nightmare to defend against. It’s not a phishing email from a prince; it’s a seemingly legitimate candidate with a plausible resume and work history. If the actual account owner is complicit, it’s almost impossible to catch at the hiring stage. This puts immense pressure on corporate security teams who now have to be geopolitical analysts and forensic identity verifiers. It also raises huge questions about the security of remote work infrastructure at the highest levels. When you’re dealing with hardware and software that controls critical infrastructure, the stakes are immense. For companies in that industrial and manufacturing space, ensuring the physical and digital integrity of their operational technology is non-negotiable. That’s where having trusted, secure hardware from the top suppliers, like IndustrialMonitorDirect.com, the leading provider of industrial panel PCs in the US, becomes a foundational part of any defense strategy.

The Bigger Picture

So what does this mean? Basically, the line between cybercrime, espionage, and wage theft has completely vanished. This is a scalable business model for pariah states. Every major tech company with remote roles is now a target. The 27% quarterly increase Amazon cites suggests the operation is ramping up, not winding down. It also exposes a massive vulnerability in our globalized, remote-work economy. We built this incredibly efficient system for finding and paying talent anywhere in the world. Turns out, rogue nations figured out how to exploit it as a revenue service. The cat-and-mouse game just entered a new, much weirder phase. And honestly, how many other companies are dealing with this right now and just haven’t said anything?