Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme
Japan, US, Australia and Germany attributed WaterPlum's fake-employer scheme to North Korea; 30,000 devices infected and $10.71 million stolen since December 2025.
A joint advisory from Japan, the US, Australia and Germany attributes the WaterPlum group (aka Contagious Interview) to North Korea's 313 General Bureau, which also runs the regime's IT-worker scheme. Between December 2025 and July 2026 the group infected at least 30,000 devices across 100+ countries by impersonating AI, crypto and NFT employers, draining over 7,000 cryptocurrency wallets for roughly $10.71 million. Japan separately dismantled its first confirmed North Korean laptop farm, and the advisory details AI face-swapping and scripted video interviews used to evade detection.