Joint Advisory Ties North Korean 'WaterPlum' Group to 30,000 Infected Devices and $10.7M Crypto Theft
Law enforcement and cybersecurity agencies from the United States, Japan, Australia, and Germany jointly warned that a North Korean hacking group known as WaterPlum compromised at least 30,000 devices in more than 100 countries between December 2025 and July 2026, transferring more than $10.7 million in stolen cryptocurrency back to North Korea. The advisory, published in mid-September, describes WaterPlum as the group behind the long-running “Contagious Interview” campaign, which lures job seekers in the technology and cryptocurrency sectors into installing malware disguised as coding tests or video-conferencing software during fake job interviews.
According to the advisory, WaterPlum operators pose as recruiters or hiring managers for legitimate AI, cryptocurrency, and NFT companies, often reaching victims through recruiting and freelance platforms. During the sham interview process, candidates are told to download a project, troubleshoot a fabricated technical issue, or run supplied code, which instead delivers one of several malware families, including a JavaScript loader hidden in npm packages, a Python-based backdoor, and an information-stealing remote access trojan. Investigators say the group has also used AI face-swapping tools during video interviews and drained more than 7,000 cryptocurrency wallets by harvesting credentials, seed phrases, and clipboard data from infected machines.
The advisory further links WaterPlum to North Korea’s broader scheme of placing operatives as fraudulent remote IT workers at Western companies, noting overlapping infrastructure between the two operations and warning that stolen identity documents from WaterPlum intrusions have been reused by North Korean IT workers seeking employment under false identities. Japanese authorities said they had, for the first time, identified and dismantled a domestic “laptop farm” used to facilitate this scheme, uncovering evidence that several hundred million yen had been moved out of the country. Investigators believe the operations are run under North Korea’s 313 General Bureau, part of the state department responsible for weapons production, underscoring how the funds are tied to the regime’s military programs rather than ordinary criminal profit.
The agencies urged companies to more rigorously verify the identity and location of job applicants and remote contractors, limit new hires’ access to only the systems needed for their role, and treat unsolicited coding assignments or downloaded interview materials as a potential attack vector rather than a routine hiring step.