North Korean Hackers Target Job Seekers in Global Cyberespionage and Crypto Theft Scheme U.S. and allied government agencies issued a joint warning on Friday, exposing a sophisticated cyber campaign by North Korean hackers known as WaterPlum (or Contagious Interview) who are infiltrating the networks of tens of thousands of job seekers worldwide. Operating under the 313 General Bureau of the Munitions Industry Department, the group poses as legitimate employers, particularly in AI, cryptocurrency, and NFT sectors, to deceive software developers and IT professionals into downloading malware. The hackers often impersonate recruiters or use third-party hiring platforms, while some members also work as North Korean IT workers, developing web systems for corporate clients. This dual approach allows them to blend in with legitimate operations while siphoning sensitive data and cryptocurrency. According to the alert issued by agencies in Japan, Australia, Germany, the FBI, and the U.S. Department of Defense’s Cyber Crime Center WaterPlum has compromised over 30,000 devices across 100+ countries, with primary targets in Japan, the U.S., and Europe. The group’s activities have enabled the theft of nearly $11 million in cryptocurrency from over 7,000 wallets, with funds funneled back to North Korea to support broader cyber operations. Investigations revealed significant overlap between WaterPlum and North Korean IT workers, including shared infrastructure, such as IP addresses used for laptop farms and cloud services. Authorities have made progress in disrupting the network, including Japan’s first successful dismantling of a laptop farm linked to the group, which facilitated the transfer of hundreds of millions of yen in crypto to foreign accounts. The FBI continues to pursue U.S.-based enablers providing support to North Korean IT workers. The warning coincides with a UN sanctions report exposing thousands of North Korean nationals employed globally in tech and other industries, further highlighting the regime’s reliance on cybercrime for revenue.

North Korea’s WaterPlum Group Steals $10.7M in Crypto via Fake Job Scams A joint advisory by Japan’s National Police Agency (NPA), the FBI, Australia’s ACSC, Germany’s BND and BfV, and the U.S. Defense Department’s Cyber Crime Center reveals that North Korea’s WaterPlum (aka Contagious Interview) hacking group compromised 30,000 devices across 100+ countries between December 2025 and July 2026, siphoning funds from 7,000+ cryptocurrency wallets and funneling $10.7 million (JPY 1.7 billion) to Pyongyang. The group, linked to North Korea’s 313 General Bureau under the Munitions Industry Department, targeted web designers, engineers, and Web3/cryptocurrency specialists through fake job interviews. Posing as employers from AI, crypto, or NFT firms, WaterPlum actors recruited victims via social media, job boards, and freelance platforms, tricking them into downloading malicious NPM packages (e.g., BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, StoatWaffel) during technical assessments. StoatWaffel, a key malware strain, was embedded in blockchain-themed Visual Studio Code projects, executing automatically when victims opened the files. Once infected, devices were hijacked with remote access trojans and infostealers, harvesting browser credentials, keystrokes, wallet private keys, seed phrases, and ID documents. The attacks also provided a foothold into victims’ employers. The advisory highlights overlap between WaterPlum and North Korea’s IT worker scheme, with some hackers doubling as fraudulent freelancers. Both groups used the same IP addresses to access laptop farms remote setups where North Korean operatives control employment devices using stolen identities and virtual private servers. Japanese authorities dismantled a laptop farm for the first time, uncovering evidence of hundreds of millions of yen moved abroad, including crypto. Some North Korean IT workers turned destructive after hiring, with incidents including extortion, source code leaks, and website defacements. The advisory notes that one worker published a company’s proprietary code after a payment dispute, while another took a client’s site offline.