Japan Dismantles First Confirmed North Korean Laptop Farm, Agencies Detail WaterPlum Scheme
Summary
A joint advisory from Japan, the US, Australia and Germany attributes a hiring and cybercrime scheme to WaterPlum. It details the group’s reported scale and methods, and Japan’s first confirmed takedown of a North Korean laptop farm.
Key points
- The advisory says WaterPlum impersonated employers and used recruiting services to target software developers and IT professionals.
- Authorities report that the group infected at least 30,000 devices in more than 100 countries between December 2025 and July 2026.
- The agencies say funds or credentials were taken from more than 7,000 cryptocurrency wallets, with an estimated $10.71 million reaching North Korea.
- Japan confirmed dismantling a laptop farm this year; authorities say the group transferred several hundred million yen in cryptocurrency overseas.
- The NPA and FBI assess that WaterPlum operators and some North Korean IT workers answer to the same North Korean government bureau.
- The advisory describes warning signs in job applications and interviews, including implausible qualifications, inconsistent language skills, cryptocurrency payment requests and suspected AI face-swapping. It also warns that compromised developers may expose employers to network intrusion, extortion or theft of sensitive information.
Article Details
- Event Type
- Joint advisory on a North Korean-linked hiring and cybercrime scheme, alongside Japan's dismantling of a laptop farm used to facilitate North Korean IT workers.
- Impact
- WaterPlum infected at least 30,000 devices across more than 100 countries and took funds or account credentials from more than 7,000 cryptocurrency wallets. Agencies estimate roughly $10.71 million reached North Korea. The advisory warns that compromised developers can provide access to employers’ networks and that stolen data has been used for extortion or to access personal information and trade secrets. Japan confirmed its first laptop-farm takedown of this kind.
Threat Actors
Countries
AustraliaLaw enforcement and intelligence agencies from Japan, the United States, Australia and Germany have published a joint advisory attributing a long-running hiring scheme to a North Korean group they call WaterPlum, alsoGermanyLaw enforcement and intelligence agencies from Japan, the United States, Australia and Germany have published a joint advisory attributing a long-running hiring scheme to a North Korean group they call WaterPlum, alsoJapanLaw enforcement and intelligence agencies from Japan, the United States, Australia and Germany have published a joint advisory attributing a long-running hiring scheme to a North Korean group they call WaterPlum, alsoNorth KoreaThe document lays out the threat group’s methods, ties some of its members to North Korea’s broader IT-worker scheme, and describes Japan’s first-ever takedown of a North Korean laptop farm.United StatesLaw enforcement and intelligence agencies from Japan, the United States, Australia and Germany have published a joint advisory attributing a long-running hiring scheme to a North Korean group they call WaterPlum, also
Industries
BlockchainThe advisory says its primary targets were web designers, engineers and specialists in cryptocurrency, blockchain and web3.CryptocurrencyWaterPlum poses as employers to reach software developers and IT professionals, often impersonating real AI, cryptocurrency or NFT companies.Web3The advisory says its primary targets were web designers, engineers and specialists in cryptocurrency, blockchain and web3.