Contagious Interview: 30,000 devices infected by a fake job interview
North Korea-linked WaterPlum infected over 30,000 devices through fake job interviews, stealing about $10.7 million.
A September 18 joint advisory from Japan's National Police Agency, the FBI, the Defense Cyber Crime Center, and agencies in Australia and Germany details North Korea-linked WaterPlum, also known as Contagious Interview. Operators pose as recruiters for AI, cryptocurrency, or NFT companies and persuade developers to download malware during fake technical interviews. At least 30,000 devices in more than 100 countries were infected, and funds or credentials were taken from over 7,000 cryptocurrency wallets, with about 1.7 billion yen ($10.71 million) sent to North Korea. Named families are BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle; officials also describe laptop farms and link activity to the 313 General Bureau.
- Over 30,000 devices in more than 100 countries were infected.
- About $10.71 million was taken from over 7,000 crypto wallets.
- Payloads include BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle.
- Targets are developers lured by fake AI, crypto, or NFT recruiters.
- Japan dismantled a laptop farm tied to DPRK IT workers.
- ATT&CK
- T1566 PhishingT1204.002 Malicious FileT1555.003 Credentials from Web BrowsersT1056.001 KeyloggingT1113 Screen Capture
- Threat actors
- WaterPlum
From the original article
4 min read at securityaffairs.com
North Korea-linked WaterPlum runs the Contagious Interview campaign, infecting over 30,000 devices using a fake job interview. On September 18, Japan’s National Police Agency, the FBI, the US Department of Defense’s Cyber Crime Center, and intelligence agencies from Australia and Germany published a joint advisory about a group called WaterPlum, better known as Contagious Interview. […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.