North korean sleeper hits amazon payroll: 110 ms gave him away
Amazon’s security team caught a North Korean operative typing 110 milliseconds too slowly. That micro-delay—smaller than a blink—blew apart Pyongyang’s newest cash machine: shipping its own engineers into U.S. tech giants, collecting Silicon Valley salaries, and wiring the proceeds straight into missile budgets.
The laptop farm in arizona
The worker looked perfect on paper: résumé scrubbed, GitHub active, interview polished. The laptop, however, landed in a ranch house outside Phoenix where a accomplice kept a glowing grid of corporate MacBooks on 24-hour standby. From Pyongyang, the real employee remote-desktoped in, hopping through three proxy layers to mask the 7,000-mile trip. The ruse worked until Amazon’s network clocks noticed every keystroke arriving 110 ms late—latency physics can’t lie.
Stephen Schmidt, Amazon’s security chief, says the company has rejected 1,800 similar applicants since January, a 27 % jump quarter-over-quarter. Each fake hire represents up to $250,000 in annual salary that would have been siphoned into North Korea’s sanctions-proof treasury. Multiply that by the thousands of open remote roles across AWS, Microsoft, and Google, and the scheme scales into nine-figure state subsidies.
Language slips and camera-shy smiles
Recruiters now flag candidates who flinch at turning cameras on, mispronounce “Palo Alto,” or overuse dated sitcom slang. Security pairs those soft signals with hard telemetry: mouse acceleration curves, VPN exit rotations, and the new gold standard—round-trip latency histograms. Miss the 40 ms ceiling for a U.S. domestic connection and the offer never comes.
Pyongang’s playbook keeps evolving. Schmidt warns the next wave will embed operatives inside hybrid teams that meet in person just often enough to pass the smell test, then retreat to “home offices” that are actually Pyongyang cyber cafés. The 110 ms tell may shrink once North Korea leases cloud nodes inside the continental U.S., collapsing geography into a rounding error.
Until then, Amazon and rivals are weaponizing stopwatches. In a remote-first industry, the shortest distance between profit and treachery is measured in milliseconds—and right now, the clock is the last firewall still holding.