Authorities Link North Korean WaterPlum to 30,000 Infected Devices and $10.7 Million in Crypto Transfers
Summary
A joint advisory says WaterPlum infected at least 30,000 devices in over 100 countries and transferred $10.7 million in cryptocurrency to North Korea. Attackers used fake interviews and coding tests to spread malware and steal data.
Key points
- Authorities say WaterPlum infected at least 30,000 devices in more than 100 countries between December 2025 and July 2026.
- The advisory attributes more than $10.7 million in cryptocurrency transfers to North Korea and says credentials or funds were taken from over 7,000 wallets.
- Attackers impersonated AI, cryptocurrency, and NFT companies, using fake interviews and coding tests to lure job seekers into running malicious code.
- The advisory links WaterPlum to BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle malware.
- Stolen data reportedly included browser credentials, cryptocurrency keys and seed phrases, keystrokes, clipboard contents, and identity documents.
- Authorities say infected devices could be used to access employers’ or clients’ networks, and that stolen identity documents were reused in fraudulent IT-worker operations.
- The advisory recommends verifying applicants’ identities and limiting access to necessary systems; developers should inspect unfamiliar code and use a sandbox.
Article Details
- Event Type
- Joint law enforcement advisory reporting a North Korean cyber campaign attributed to WaterPlum.
- Impact
- Authorities report that WaterPlum infected at least 30,000 devices in more than 100 countries from December 2025 through July 2026, stole funds or account credentials from over 7,000 cryptocurrency wallets, and transferred cryptocurrency worth approximately $10.71 million to North Korea. The activity also involved theft of credentials, identity documents, and other data, with possible access to victims’ employers’ or clients’ networks.
MITRE ATT&CK
T1056.001 · KeyloggingThe attackers sought to capture victims’ keystrokes.T1059.006 · PythonInvisibleFerret is described as a Python-based backdoor.T1059.007 · JavaScriptBeaverTail is described as JavaScript malware, and victims were instructed to run malicious code.T1555.003 · Credentials from Web BrowsersThe attackers attempted to steal browser credentials.T1566 · PhishingAttackers used fake job postings, interviews, and recruiter impersonation to lure job seekers into the campaign.
Threat Actors
Malware
Products
npmWaterPlum is linked to a multi-year campaign known as “Contagious Interview,” which has previously targeted job seekers with malicious npm packages hat infect their devices with malware.VSCodeStoatWaffle: Modular Node.js malware delivered through malicious Visual Studio Code projects, using configuration files that execute code after a folder is opened and trusted.
Countries
JapanJapan’s National Police Agency says authorities identified, investigated, and dismantled a North Korean IT-worker “laptop farm” in the country for the first time, finding evidence that several hundred million yen hadNorth KoreaWaterPlum, a North Korean hacking group, compromised at least 30,000 devices in more than 100 countries and sent over $10.7 million in stolen cryptocurrency to North Korea.