Joint Advisory Details North Korean WaterPlum Attacks and IT-Worker Schemes
Summary
A multi-agency advisory says North Korean WaterPlum actors used fake job interviews and malicious code to infect 30,000+ devices, target crypto wallets, and steal funds. It also describes North Korean IT-worker schemes and offers mitigation steps.
Key points
- Authorities attribute WaterPlum, also called Contagious Interview, to North Korean actors and say it targets IT professionals with fake job opportunities.
- The advisory reports at least 30,000 infected devices in more than 100 countries and cryptocurrency theft or credential harvesting from over 7,000 wallets.
- Attackers reportedly deliver malware through malicious NPM packages and coding assignments, then use RATs and infostealers to maintain access and exfiltrate data.
- Stolen data may include credentials, cryptocurrency wallet information, personal IDs, screenshots, keystrokes, and files; the advisory warns of possible follow-on targeting of employers and clients.
- Authorities describe laptop farms and facilitators enabling North Korean IT workers to obtain contracts and route payments; a Japanese exchange rejected a suspected applicant, and no damage occurred.
- Recommended steps include avoiding untrusted code, reviewing VS Code projects and tasks files, limiting contractor access, revoking accounts if needed, and isolating suspected infected devices.
Article Details
- Event Type
- Multi-agency cybersecurity advisory on North Korean WaterPlum (also referred to as Contagious Interview) targeting IT professionals and on North Korean IT workers generating revenue through fraudulent employment.
- Impact
- Authorities report that WaterPlum infected at least 30,000 devices in more than 100 countries and stole funds or credentials from over 7,000 cryptocurrency wallets, with at least 1.7 billion JPY (10.71 million USD) in cryptocurrency exfiltrated for the DPRK. Stolen credentials and personal data may enable further theft, espionage, intellectual property theft, lateral movement, and extortion. The advisory also describes cases of source-code publication and website defacement by North Korean IT workers.
Threat Actors
Malware
BeaverTail2 BeaverTail is JavaScript-based malware hidden inside Node Package Manager (NPM) packages, and canInvisibleFerret3 InvisibleFerret malware is a Python-based backdoor to the victims’ computer networks.OtterCandy5 OtterCandy malware combines the features of OtterCookie and RATatouille.OtterCookie4 OtterCookie is a JavaScript-based Remote Access Trojan (RAT) and information-stealing malware.StoatWaffle6 StoatWaffle is a modular Node.js malware family combining a malware loader, credential harvesting
Products
Countries
ChinaKorea, China, or Russia, with a small number residing in Africa and Southeast Asia.Japanof North Korean IT Workers in Japan, the United States and EuropeNorth Koreacombat cyberattacks that benefit North Korea and North Korean IT worker revenue-RussiaKorea, China, or Russia, with a small number residing in Africa and Southeast Asia.United Statesof North Korean IT Workers in Japan, the United States and Europe