Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme
Japan, US, Australia and Germany attributed WaterPlum's fake-employer scheme to North Korea; 30,000 devices infected and $10.71 million stolen since December 2025.
A joint advisory from Japan, the US, Australia and Germany attributes the WaterPlum group (aka Contagious Interview) to North Korea's 313 General Bureau, which also runs the regime's IT-worker scheme. Between December 2025 and July 2026 the group infected at least 30,000 devices across 100+ countries by impersonating AI, crypto and NFT employers, draining over 7,000 cryptocurrency wallets for roughly $10.71 million. Japan separately dismantled its first confirmed North Korean laptop farm, and the advisory details AI face-swapping and scripted video interviews used to evade detection.
- WaterPlum tied to DPRK 313 General Bureau alongside IT-worker scheme operators
- 30,000+ devices infected, 7,000+ wallets drained, ~$10.71M reached North Korea
- Japan dismantled its first confirmed North Korean laptop farm
- AI face-swapping used during video interviews to hide operatives' identities
- Compromised developers provide a path into employer networks and extortion material
- Tags
- waterplumcontagious-interviewnorth-korealaptop-farmcryptocurrency-theftjoint-advisoryit-worker-scheme
From the original article
3 min read at securityweek.com
The US, Japan, Germany and Australia have published a joint report detailing the scope of North Korea’s WaterPlum campaign. The post Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.