North Korean WaterPlum Uses Fake Job Offers to Target IT Professionals

Summary

A joint agency advisory says WaterPlum, also known as Contagious Interview, uses fake recruiting and coding tests to infect IT professionals and steal credentials and cryptocurrency. It details the activity, a Japanese hiring case and defenses.

Key points

The advisory describes WaterPlum using fake job offers, interviews and coding assignments to trick developers into running malicious files, including packages carrying BeaverTail, InvisibleFerret, OtterCookie, OtterCandy or StoatWaffle.
Authorities report the actors use remote-access Trojans and information stealers to maintain access and target credentials, cryptocurrency wallet data, personal information and files.
Japanese authorities report at least 30,000 PCs in more than 100 countries were exploited and funds or credentials were taken from more than 7,000 cryptocurrency wallets; the advisory attributes these findings to investigations.
The advisory describes North Korean IT workers using false identities, enablers and remotely operated laptop farms to obtain contracts and generate revenue.
A Japanese cryptocurrency exchange rejected a suspected North Korean IT worker applicant after identifying inconsistencies during recruitment; the advisory says no damage occurred.
Recommended safeguards include verifying applicants and credentials, restricting access to sensitive systems and data, and avoiding execution of code from unknown parties.
For suspected infection, the advisory recommends disconnecting the device, assuming sensitive data may have been exfiltrated, moving cryptocurrency to a new wallet on a separate device, and resetting the operating system.

Article Details

Defense Focus: Prevent malicious code execution during recruitment and protect IT professionals, cryptocurrency assets, and employer systems from WaterPlum activity and suspected North Korean IT worker infiltration.
Detection Methods: Inspect unknown VS Code projects and their .vscode/tasks.json files for code that downloads or executes additional files; use Restricted Mode and avoid opening projects from previously trusted paths.
Use EDR to monitor for malicious behavior on endpoints.
Review commands and scripts for suspicious strings identified in the advisory, including curl, base64, -enc, mshta, iwr-uri, and hidden.
During recruitment, verify applicant identity, qualifications, work history, contact information, certifications, and consistency between claimed skills and interview responses.
Look for interview warning signs reported in the advisory, such as refusal of in-person meetings, requests for cryptocurrency payment, frequent glances at another monitor, background voices, or repeated video and audio freezes.
Where possible, check whether an applicant's IP address generally matches their claimed residence.
Data Sources: Endpoint and EDR activity, including suspected external communications from an infected device.
VS Code project files, especially .vscode/tasks.json.
Applicant IP addresses, resumes, contact details, certifications, and interview observations.
Platforms: Endpoint Detection and Response (EDR)
Defensive Actions: Do not run code, scripts, or software supplied by unknown parties; if necessary, inspect and run unknown code only in a sandbox or virtual machine.
Open unfamiliar VS Code projects in Restricted Mode and verify project task files before execution.
Limit access to source code, credentials, and other sensitive information to the minimum necessary; promptly revoke accounts and sessions if a contractor may be malicious.
If infection is detected or suspected, disconnect the affected device from the internet. Assume sensitive data may already have been exfiltrated.
For suspected cryptocurrency compromise, create a new wallet on a separate device, transfer assets, and store the new seed phrase offline; back up essential data and fully reset the affected operating system.
Strengthen applicant and contractor identity checks and review outsourcing and freelance engagement practices.