Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto
North Korea's Contagious Interview campaign hit 30,000 devices and stole about $10.71 million in crypto.
A joint advisory from agencies in Japan, the United States, Australia, and Germany says North Korean actors behind Contagious Interview, tracked in the alert as WaterPlum, compromised at least 30,000 devices in more than 100 countries. They took funds or credentials from more than 7,000 cryptocurrency wallets, estimated at $10.71 million, mainly targeting developers and Web3 specialists. Since at least 2022, operators pose as recruiters on LinkedIn, send coding tests, and deploy malware including BeaverTail, InvisibleFerret, FlexibleFerret, and OtterCookie, then use remote-access malware for persistence and data theft. Agencies also report overlap with North Korean IT-worker operations, a dismantled laptop farm in Japan, and Discord recruitment of interview proxies.
- At least 30,000 devices in more than 100 countries were compromised.
- Actors stole funds or credentials from over 7,000 crypto wallets, about $10.71 million.
- Fake recruiters on LinkedIn push coding tests that install multiple malware families.
- A facilitator-run laptop farm in Japan was identified and dismantled.
- Related IT-worker activity recruits interview proxies through a Discord server.
From the original article
4 min read at thehackernews.com
The North Korean threat actors behind the Contagious Interview campaign have compromised at least 30,000 devices located in more than 100 countries and siphoned funds or account credentials from over 7,000 cryptocurrency wallets, according to a new joint cybersecurity advisory. The primary targets of the campaign are individual web designers, engineers, and specialists in cryptocurrency,
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.