North Korean WaterPlum Hackers Target IT Professionals With Fake Job Interviews to Steal Crypto
North Korean WaterPlum actors used fake job interviews to infect 30,000 devices and steal crypto from 7,000+ wallets, netting roughly $10.71 million.
North Korean group WaterPlum (Contagious Interview) lures developers and crypto professionals via fake job interviews on social media, job portals, and freelance platforms, then delivers malware as coding assignments or video-conferencing fixes hosted on code repositories. IC3 attributes theft from more than 7,000 cryptocurrency wallets to the campaign, yielding an estimated $10.71 million (JPY 1.7 billion) for the DPRK. Known malware families include BeaverTail (JavaScript/npm), InvisibleFerret (Python backdoor), OtterCookie, OtterCandy, and StoatWaffle (malicious Visual Studio Code projects). Attackers reportedly used AI face-swapping during video interviews, and investigators linked the activity to DPRK IT-worker schemes using laptop farms and VPNs.
- Campaign infected 30,000+ devices in over 100 countries, targeting web developers, freelancers, and cryptocurrency professionals.
- IC3 tied the operation to theft from over 7,000 wallets, generating about $10.71 million for the DPRK.
- Malware families include BeaverTail (npm JavaScript), InvisibleFerret (Python backdoor), OtterCookie, OtterCandy, and StoatWaffle (VS Code projects).
- Payloads were delivered via coding assignments hosted on code repositories, reportedly using AI face-swapping during interviews.
- Defenders should run unknown code in VMs, keep VS Code in Restricted Mode, rotate credentials, and deploy EDR with least privilege.
- ATT&CK
- T1566.003 Spearphishing via ServiceT1204.002 Malicious FileT1195.002 Compromise Software Supply ChainT1555.003 Credentials from Web BrowsersT1059.006 Python
- Tags
- beavertailcontagious-interviewcryptocurrencyinvisibleferretnorth-koreaottercookiesocial-engineeringwaterplum
- Vendors
- Visual Studio
- Products
- Visual Studio Codenpm
- Threat actors
- WaterPlumContagious InterviewDPRK
- Organizations
- FBI Internet Crime Complaint Center (IC3)
- Countries
- North Korea
From the original article
3 min read at gbhackers.com
North Korean threat actors, known as WaterPlum (also referred to as Contagious Interview), have infected at least 30,000 devices in over 100 countries by luring software developers and IT professionals into malicious job interviews. This campaign specifically targets web developers, freelancers, blockchain specialists, and cryptocurrency professionals.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.