Agencies Warn North Korean WaterPlum Group Is Targeting Job Seekers to Steal Crypto and Data
Summary
Agencies say North Korean-linked WaterPlum has infected over 30,000 devices in 100+ countries through fake recruiting schemes, moving nearly $11 million in cryptocurrency. Authorities have dismantled a laptop farm in Japan.
Key points
- WaterPlum, also known as Contagious Interview, impersonates AI, cryptocurrency and NFT companies to lure software developers and IT professionals.
- The campaign has infected more than 30,000 devices across over 100 countries, according to the government alert.
- The alert says operations moved nearly $11 million in cryptocurrency from more than 7,000 wallets to North Korea.
- Agencies reported substantial overlap between WaterPlum and North Korean IT workers, including shared IP addresses used to access laptop farms and apply for jobs.
- Japanese authorities identified and dismantled a laptop farm operated by an alleged enabler; the FBI is pursuing U.S.-based facilitators.
Article Details
- Event Type
- Government warning about a North Korean cyber campaign targeting job seekers through fake recruiting schemes
- Impact
- The campaign reportedly infected more than 30,000 devices across over 100 countries and transferred nearly $11 million in cryptocurrency from more than 7,000 wallets to North Korea. Authorities reported dismantling a laptop farm in Japan and are seeking further cooperation.
Threat Actors
Countries
Australiaand development tasks on corporate web systems for clients,” read the alert from agencies in Japan, Australia and Germany, alongside the FBI and the Department of Defense’s Cyber Crime Center.Germanytasks on corporate web systems for clients,” read the alert from agencies in Japan, Australia and Germany, alongside the FBI and the Department of Defense’s Cyber Crime Center.JapanAuthorities have disrupted some operations, including a laptop farm in Japan.North KoreaThe campaign has infected more than 30,000 devices worldwide and helped move nearly $11 million in cryptocurrency to North Korea through stolen credentials and fake recruiting schemes.United StatesCollectively, WaterPlum has infected more than 30,000 devices in more than 100 countries, targeting IT professionals in Japan, the United States, Europe and other nations.