North Korean group WaterPlum stole at least $10.7M in crypto

North Korean cyber group WaterPlum, also known as Contagious Interview, stole at least $10.7 million by posing as recruiters for legitimate cryptocurrency, AI and NFT companies. The group targeted software developers, IT professionals, web designers, engineers and specialists in cryptocurrency, blockchain and Web3 technologies worldwide, according to a joint advisory from Japan, Germany, Australia and the United States. The fake recruiters used social media, online job platforms, gig-work platforms, freelance marketplaces and recruiting services to reach job seekers. Victims were instructed to download and execute malicious files disguised as coding assignments or fixes for videoconferencing errors. After gaining backdoor access to computers, the actors used remote-access trojans and infostealing malware to extract sensitive data and cryptocurrency. The infections also created opportunities to infiltrate organizations employing the targeted developers. WaterPlum infected at least 30,000 devices in more than 100 countries, and funds or account credentials were extracted from more than 7,000 cryptocurrency wallets between December 2025 and July 2026. The advisory said stolen identity documents could allow North Korean IT workers to impersonate victims and earn income, while sensitive information could be used for extortion. It linked WaterPlum to North Korea's broader effort to place IT workers inside foreign companies, with Japanese and US authorities assessing that WaterPlum actors and some North Korean IT workers operate under North Korea's Munitions Industry Department. In one case, a suspected North Korean IT worker applied for an engineering role at a Japanese crypto exchange using a forged resume. The exchange rejected the applicant after finding discrepancies during the interview, including an inability to explain the listed skills in detail. In another case in July, Consensys unknowingly engaged a North Korea-linked developer as a consultant. Consensys said it terminated the developer's access after discovering the threat, and an investigation found no theft of assets or data, malicious code deployment or impact on user safety. The campaign was described as the latest example of North Korea's use of cryptocurrency theft to raise funds despite years of warnings and enforcement. The FBI blamed North Korea for the $1.5 billion Bybit theft in February 2025, and US authorities have warned about its undercover IT workers since at least 2018.