North Korean Hackers Infect 30,000 Devices in Global Cyberespionage Campaign North Korean threat actors, tracked as WaterPlum (also known as Contagious Interview), have compromised at least 30,000 devices across over 100 countries by exploiting job recruitment schemes targeting software developers, IT professionals, and cryptocurrency specialists. The campaign, active in recent months, has resulted in the theft of $10.71 million (JPY 1.7 billion) from over 7,000 cryptocurrency wallets, according to reports from the IC3 (Internet Crime Complaint Center). ### Attack Methodology WaterPlum operators engage victims through social media, job portals, freelance platforms, and recruitment services, posing as legitimate AI, blockchain, or NFT companies. The attackers lure targets with fake job interviews, often requesting coding assignments or troubleshooting tasks under the guise of technical evaluations. Malicious files disguised as necessary tools for development or video conferencing are hosted on code repositories and collaboration platforms, making them appear credible to tech-savvy victims. In some cases, attackers used AI face-swapping software during interviews, later disabling video feeds to avoid detection. ### Malware Arsenal The campaign deploys multiple malware strains, including: - BeaverTail – JavaScript-based malware hidden in npm packages. - InvisibleFerret – A Python backdoor for remote access. - OtterCookie – A remote access Trojan (RAT) and infostealer that exfiltrates sensitive data. - StoatWaffle – Malicious Visual Studio Code projects that execute code via configuration files (e.g., `.vscode/tasks.json`). Once installed, the malware harvests browser credentials, cryptocurrency wallet keys, seed phrases, screenshots, keystrokes, and sensitive files, enabling further compromise of victims’ employers, clients, or projects. ### Broader Implications Authorities link WaterPlum to DPRK IT-worker schemes, where North Korean operatives use laptop farms and virtual private servers (VPS) to obscure their locations, secure overseas contracts, and launder illicit earnings. Japanese investigators found overlapping IP addresses between WaterPlum and suspected North Korean IT workers accessing crowdsourcing platforms. The stolen credentials and access tokens pose risks of corporate espionage, intellectual property theft, lateral movement within networks, and extortion. Security experts warn that compromised developers could inadvertently grant attackers access to enterprise systems, customer data, and ongoing projects.