North Korean Hacking Group WaterPlum Compromises 30,000 Devices and Laundered Millions in Global Cryptocurrency Scheme

A sophisticated and expansive cyber-espionage and financial theft campaign, orchestrated by the North Korean threat actor known as WaterPlum, has resulted in the compromise of at least 30,000 devices across more than 100 countries. According to a landmark joint advisory issued in September 2026 by authorities in Japan, the United States, Australia, and Germany, this campaign—active between December 2025 and July 2026—served as a critical revenue-generation mechanism for the Democratic People’s Republic of Korea (DPRK). The attackers successfully siphoned and laundered over $10.7 million (1.7 billion Japanese yen) in cryptocurrency, funneling these assets directly to the North Korean regime to support its state-sanctioned weapons programs.

The scope of this operation, often referred to in security circles as "Contagious Interview," represents a significant escalation in how state-sponsored actors leverage the global gig economy to bypass international sanctions and penetrate secure corporate networks. By blending high-tech social engineering with traditional malware distribution, WaterPlum has effectively weaponized the remote hiring process, turning legitimate IT recruitment into a gateway for industrial espionage and financial crime.

The Mechanics of the Contagious Interview Campaign

The WaterPlum operation is characterized by its focus on the professional technology sector. The group frequently impersonates legitimate entities within the AI, cryptocurrency, and NFT industries. By utilizing established freelance platforms and professional networking sites, the actors solicit job applications from unsuspecting developers and IT professionals.

The transition from a professional interview to a full-scale system compromise is meticulously planned. During the recruitment phase, victims are often subjected to "coding challenges" or "technical assessments." In these instances, the attackers direct candidates to download specialized software, purportedly to troubleshoot video-conferencing connectivity issues or to run proprietary project files. Once executed, these files deploy malicious payloads, including sophisticated malware designed to exfiltrate data.

Investigators have identified that the group utilizes advanced AI-powered face-swapping software during video interviews to maintain the facade of a legitimate recruiter. If a candidate begins to suspect the validity of the meeting, the actors often preemptively disconnect their camera, citing sudden network instabilities, a tactic that has become a hallmark of WaterPlum’s social engineering playbook.

Chronology of the 2025-2026 Offensive

The timeline of the WaterPlum activity highlights a period of intense operational growth:

• December 2025: Initial surge in the deployment of malicious npm packages. The group begins targeting job seekers with increased frequency, masquerading as high-growth tech startups.
• February 2026: The first major wave of "Contagious Interview" attacks is documented, with significant compromises reported in the Asia-Pacific region.
• May 2026: Evidence emerges linking the malware campaigns to a wider network of "fraudulent IT workers." Intelligence agencies begin to notice a convergence between remote workers and the WaterPlum hacking infrastructure.
• July 2026: The peak of the campaign. Authorities note the transfer of the final tranches of the $10.7 million haul to North Korean-linked wallets.
• September 2026: The United States, Japan, Germany, and Australia release a coordinated advisory, formalizing the attribution to the 313 General Bureau of the DPRK.

Supporting Data and Technical Implications

The technical sophistication of WaterPlum lies in its ability to extract sensitive data once a device is compromised. Analysis of the malware families associated with the group shows a capability to steal browser-stored credentials, clipboard contents, keystrokes, and, most importantly, cryptocurrency private keys and seed phrases.

The impact of these infections is not limited to the individual machine. Once a victim’s device is under their control, the hackers pivot laterally through the network to access the employer’s internal environment. This allows for intellectual property theft, the exfiltration of trade secrets, and the potential for long-term persistence within high-value corporate networks.

Data from the joint investigation confirms that over 7,000 cryptocurrency wallets were directly compromised, with funds being moved through complex laundering chains to obscure the source. The advisory emphasizes that the attackers often reuse identity documents stolen from their initial victims to facilitate further recruitment efforts, essentially creating a circular loop of identity theft that is difficult for human resources departments to detect.

The Intersection of Cybercrime and State Strategy

The investigation by the Japanese National Police Agency—which resulted in the dismantling of a physical "laptop farm" used by North Korean IT workers—has shed light on the structural support provided by the regime. Analysts believe that both the WaterPlum hackers and the fraudulent remote IT workers operate under the umbrella of the 313 General Bureau, a specialized unit within the DPRK’s Munitions Industry Department.

This connection is critical to understanding the geopolitical implications of the campaign. The revenue generated by these cyber-theft operations is not for private enrichment but is a state-directed enterprise designed to provide hard currency for North Korea’s weapons research and ballistic missile development. By infiltrating legitimate IT development pipelines, the regime is not only stealing money but is also embedding its personnel into the very infrastructure of global technology firms, posing a long-term risk to national security.

Global Responses and Defensive Recommendations

The joint advisory serves as a stern warning to the international business community. The FBI and its international partners have underscored the necessity of robust identity verification for remote hires. Companies are encouraged to move beyond standard resume vetting and implement multi-factor authentication, rigorous background checks, and strictly enforced the principle of least privilege.

"The threat landscape has evolved," stated one cybersecurity expert analyzing the report. "When an actor can use AI to impersonate a human during a high-stakes technical interview, the human element becomes the primary vulnerability."

Defense strategies recommended by the coalition of international agencies include:

• Sandbox Environment Utilization: Developers should never execute code from unknown sources on host machines; instead, they must utilize isolated sandbox environments or virtual machines.
• Enhanced Verification: Organizations should implement video verification protocols that go beyond simple screen-sharing, and HR departments should utilize independent, third-party identity verification services.
• Code Auditing: Companies must treat all third-party dependencies, including npm packages and provided test files, as potentially malicious. Automated code scanning should be mandatory for any software submitted during the recruitment process.

Broader Impact and Future Outlook

The WaterPlum case underscores a maturing threat environment where the boundaries between cybercrime, state-sponsored espionage, and economic warfare have effectively vanished. By exploiting the global reliance on remote work, North Korean actors have successfully turned the tools of modern digital business against the companies that created them.

As the international community grapples with the fallout of the 2026 campaign, the focus is shifting toward proactive defense. The dismantling of the "laptop farm" in Japan represents a rare, tangible victory against the physical infrastructure of these campaigns, but security analysts warn that the underlying threat remains fluid. As AI tools for face-swapping and automated code generation become more accessible, the barrier to entry for such operations will continue to lower.

The implication for the future is clear: the digital hiring process is no longer just an HR function—it is a critical security perimeter. Organizations that fail to secure their recruitment pipelines from the "Contagious Interview" threat risk not only the theft of their own intellectual property but also the inadvertent subsidization of international bad actors. The challenge now lies in balancing the benefits of a globalized, remote workforce with the rigorous security standards required to repel a state-backed adversary.