International security agencies warn about North Korean hackers exploiting job seekers to steal crypto, data
US, Japanese, German, and Australian agencies warn North Korea's WaterPlum gang poses as recruiters, infecting 30,000+ devices and stealing about $11 million in crypto.
The FBI, DoD Cyber Crime Center, and agencies from Japan, Germany, and Australia attributed WaterPlum (Contagious Interview) to the 313 General Bureau of North Korea's Munitions Industry Department under the Workers' Party of Korea. The group poses as recruiters from fake AI, cryptocurrency, and NFT companies to target software developers and IT professionals, infecting more than 30,000 devices in over 100 countries. Operators have transferred roughly $11 million in cryptocurrency from more than 7,000 wallets to North Korea. Japanese authorities dismantled a laptop farm for the first time, and WaterPlum actors substantially overlap with North Korean IT worker schemes, sharing IP addresses and infrastructure.