North Korean Attackers Hit 30,000 Devices and Steal $10.7m
North Korea's WaterPlum infected about 30,000 devices and stole roughly $10.7 million in cryptocurrency.
A joint advisory from Japan's NPA, the FBI, Australia's ACSC, and German services says WaterPlum, also known as Contagious Interview, infected at least 30,000 devices in more than 100 countries between about December 2025 and July 2026. Actors posed as employers and delivered BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, or StoatWaffle through malicious NPM packages and Visual Studio Code projects, stealing credentials and wallet keys from over 7,000 cryptocurrency wallets. At least JPY 1.7 billion ($10.7 million) was transferred to North Korea. Agencies link some activity to North Korean IT workers under the 313 General Bureau and say Japan dismantled a laptop farm.
- About 30,000 devices in over 100 countries were infected
- More than 7,000 crypto wallets were looted, totaling about $10.7 million
- Fake interviews pushed malware via NPM packages and VS Code projects
- Japan dismantled a laptop farm tied to North Korean IT workers
- Agencies attribute overlap to the 313 General Bureau
Full article455 words · extracted from infosecurity-magazine.com · click to collapse
North Korea's WaterPlum group, commonly referred to as Contagious Interview, has infected at least 30,000 devices in more than 100 countries and taken funds or credentials from over 7,000 cryptocurrency wallets, according to a new joint advisory.
Japan's National Police Agency (NPA) and National Cybersecurity Office, the FBI, the Defense Department's Cyber Crime Center, Australia's ACSC and Germany's BND and BfV said the activity ran from around December 2025 to July 2026. At least JPY1.7bn ($10.7m) in cryptocurrency was transferred to North Korea.
The NPA and FBI assessed that WaterPlum and some North Korean IT workers operate under the 313 General Bureau, part of the Munitions Industry Department which is subordinate to the Central Committee of the Workers Party of Korea.
Fake Job Interviews Deliver Malware
WaterPlum actors posed as employers, often impersonating AI, cryptocurrency or NFT companies, and recruited developers through social media, job boards and freelance marketplaces. The main targets were web designers, engineers and cryptocurrency and Web3 specialists.
During technical interviews or coding assignments, victims were told to download and run files hosted on developer platforms and code repositories. The actors seeded malicious NPM packages carrying BeaverTail, InvisibleFerret, OtterCookie, OtterCandy or StoatWaffle.
StoatWaffle arrives in blockchain-themed Visual Studio Code (VSC) projects that run code automatically once a victim trusts the folder. The agencies advised opening unknown projects in Restricted Mode and checking any tasks.json file before running it.
Once inside, the actors used remote access trojans and infostealers to take browser credentials, keystrokes, screenshots, wallet private keys and seed phrases, and ID documents. Infections also gave them a path into the victims' employers.
WaterPlum and IT Workers Overlap
The advisory ties WaterPlum closely to North Korea's IT worker scheme, stating that some WaterPlum actors also work as North Korean IT workers. The two used the same IP addresses to reach laptop farms and crowdsourcing services and to apply for jobs at a Japanese cryptocurrency exchange.
Laptop farms are sites, often an enabler's home, where employment computers are set up and controlled remotely by North Korean workers. Enablers supply identity documents, bank accounts and virtual private servers to hide where the workers are.
Read more on IT worker fraud: North Korean Hiring Fraud Runs on AI and US Laptop Farms
Japanese authorities identified and dismantled a laptop farm in Japan for the first time, the advisory said. Their investigations suggest North Korean IT workers moved several hundred million yen abroad, including cryptocurrency.
Some workers turned destructive once hired. One extorted a company over payment and published its source code, and another defaced a client's website and took it offline.
The agencies urged firms to limit contractors' access to source code and credentials, verify applicants' identities and consider risks from downstream subcontractors.