110 Milliseconds of Truth: How Amazon Used “Lag” to Catch a North Korean Spy

According to Bloomberg, Amazon disclosed proactive efforts to counter North Korean hacking operations, noting that since April 2024 it has thwarted more than 1,800 attempted intrusions linked to North Korean hackers. The company says quarter over quarter, attempts to penetrate its systems have increased by 27%, with attackers often posing as legitimate job applicants to secure remote positions.

The typical scheme involves paying U.S. residents to run innocuous side gigs that involve buying and maintaining large numbers of laptops connected to domestic networks, which are then used to support fraudulent résumés for remote roles at major tech firms. In 2025 alone, North Korean hackers used this method to attack multiple cryptocurrency companies and platforms, and some attackers reportedly joined Amazon using fabricated credentials.

Earlier in 2025, behavioural monitoring on a newly hired systems administrator’s laptop triggered alerts, and Amazon’s security specialists determined that the laptop was being controlled remotely, with latency spiking to 110 milliseconds. They also note that attackers frequently betray themselves through linguistic slips and inconsistencies in written English, which help flag such intrusions.