International security agencies warn about North Korean hackers exploiting job seekers to steal crypto, data
US, Japanese, German, and Australian agencies warn North Korea's WaterPlum gang poses as recruiters, infecting 30,000+ devices and stealing about $11 million in crypto.
The FBI, DoD Cyber Crime Center, and agencies from Japan, Germany, and Australia attributed WaterPlum (Contagious Interview) to the 313 General Bureau of North Korea's Munitions Industry Department under the Workers' Party of Korea. The group poses as recruiters from fake AI, cryptocurrency, and NFT companies to target software developers and IT professionals, infecting more than 30,000 devices in over 100 countries. Operators have transferred roughly $11 million in cryptocurrency from more than 7,000 wallets to North Korea. Japanese authorities dismantled a laptop farm for the first time, and WaterPlum actors substantially overlap with North Korean IT worker schemes, sharing IP addresses and infrastructure.
- WaterPlum attributed to the 313 General Bureau of the Workers' Party of Korea
- Poses as AI, crypto, and NFT recruiters to infect 30,000+ devices in 100+ countries
- Nearly $11 million in cryptocurrency transferred from over 7,000 wallets
- Japan dismantled a laptop farm; FBI prosecuting US-based facilitators
- Substantial overlap with North Korean IT worker operations and laptop farms
- Threat actors
- WaterPlumContagious Interview
From the original article
3 min read at cyberscoop.com
The U. S. , Japan, Germany and Australia said WaterPlum operators pose as prospective employers and have infected more than 30,000 devices worldwide.
By Tim Starks · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.