North Korean Attackers Hit 30,000 Devices and Steal $10.7m
North Korea's WaterPlum infected about 30,000 devices and stole roughly $10.7 million in cryptocurrency.
82
Malware
OtterCandy
- Mentions · 7d0
- Mentions · 30d0
- All mentions7
- First seenSep 18, 2026
- Last mentionedSep 22, 2026
Timeline
7 articles · newest firstContagious Interview: 30,000 devices infected by a fake job interview
North Korea-linked WaterPlum infected over 30,000 devices through fake job interviews, stealing about $10.7 million.
84
Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto
North Korea's Contagious Interview campaign hit 30,000 devices and stole about $10.71 million in crypto.
82
North Korean WaterPlum Hackers Infect 30,000 PCs via Fake Job Interviews, Steal $10.7M Crypto
North Korean WaterPlum actors posed as recruiters to infect 30,000 developers' PCs and steal $10.7M in cryptocurrency via BeaverTail, InvisibleFerret and other malware.
78
North Korean WaterPlum hackers infected 30,000 devices worldwide
Joint US, Japan, Australia, Germany advisory links North Korean WaterPlum group to 30,000 infected devices and $10.7 million in stolen cryptocurrency.
78
North Korean WaterPlum Hackers Target IT Professionals With Fake Job Interviews to Steal Crypto
North Korean WaterPlum actors used fake job interviews to infect 30,000 devices and steal crypto from 7,000+ wallets, netting roughly $10.71 million.
76
North Korean hackers infect thousands of devices across 100 countries as part of ‘WaterPlum’ campaign
FBI and Japanese police advisory ties North Korea's WaterPlum campaign to $10.5M stolen from job seekers via fake-recruiter malware on 30,000 devices.
80
Appears with
- InvisibleFerretmalware · 7
- OtterCookiemalware · 7
- BeaverTailmalware · 7
- WaterPlumthreat actor · 7
- StoatWafflemalware · 7
- FBIorganization · 4
- Visual Studio Codeproduct · 4
- National Police Agencyorganization · 3
- 313 General Bureauorganization · 2
- Contagious Interviewthreat actor · 2
- npmproduct · 2
- DTEXorganization · 1
- BfVorganization · 1
- General Bureau of the Munitions Industry Departmentthreat actor · 1
- North Koreathreat actor · 1
- LinkedInorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.