North Korea's fake job interviews infected 30,000 devices
International advisories attribute 30,000 compromised devices, 7,000 crypto wallets, and $10.71 million in thefts to North Korea's WaterPlum fake-recruiter malware campaigns.
Law enforcement and cybersecurity agencies from Australia, Germany, Japan, and the US issued a joint advisory update Thursday on WaterPlum, North Korea's fake-recruiter campaign. Operators pose as recruiters targeting web designers, engineers, and cryptocurrency/Web3 specialists with bogus coding tests that install remote access trojans and information stealers. The attackers compromised more than 7,000 crypto wallets and stole at least $10.71 million, funneled to Pyongyang. The scheme complements North Korea's IT worker fraud, estimated at roughly $500 million annually from about 100,000 workers worldwide.
- WaterPlum operators pose as recruiters targeting web designers, engineers, and crypto/Web3 specialists.
- Victims open bogus coding assignments that install RATs and information stealers.
- Agencies attribute at least $10.71 million in thefts across more than 7,000 crypto wallets.
- Stolen IDs, credentials, and wallet data enable impersonation, extortion, and employer network access.
- Complements North Korea's IT worker fraud, estimated at $500 million annually.
- ATT&CK
- T1566.003 Spearphishing via ServiceT1204.002 User Execution: Malicious FileT1056.001 Input Capture: KeyloggingT1115 Clipboard DataT1005 Data from Local System
From the original article
2 min read at theregister.comWaterPlum recruiters used bogus coding tests to backdoor jobseekers and raid more than 7,000 crypto wallets
By Connor Jones · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.