Joint Advisory: North Korean Group WaterPlum Steals $10.7M via Fake Tech Interviews

Key points

• WaterPlum infected 30,000 devices globally and exfiltrated $10.7 million in crypto from over 7,000 wallets.
• The group used the 'Contagious Interview' campaign, targeting job seekers with malicious npm packages and fake coding tests.
• Attackers employed AI face-swapping during video interviews and blamed network issues for camera failures to maintain deception.
• Stolen identity documents were reused by North Korean IT workers to impersonate victims and secure remote jobs.
• Japan dismantled a North Korean 'laptop farm' for the first time, finding evidence of hundreds of millions of yen transferred abroad.

Background

This cyber operation aligns with broader trends of North Korea leveraging labor and technology to fund state initiatives. Recent reports indicate Pyongyang is supplying drones and troops to Russia, while also engaging in financial crimes to support its weapons programs. The WaterPlum campaign represents a sophisticated evolution of these revenue-generating tactics, directly linking cyber theft to military funding.

How outlets are covering it

BleepingComputer provides the most detailed technical breakdown, listing specific malware families like BeaverTail and StoatWaffle, and explicitly linking WaterPlum to the 313 General Bureau. The Register focuses on the deceptive tactics, highlighting the use of AI face-swapping and the 'Contagious Interview' campaign. Yahoo offers a high-level summary of the financial impact, emphasizing the $11 million drain from crypto wallets without delving into the specific malware mechanics or the labor fraud connections.

Why it matters

This incident highlights a critical vulnerability in remote hiring practices, where identity verification fails against sophisticated AI-driven deception. It demonstrates how state-sponsored cyber groups are increasingly blending financial theft with labor fraud to fund military programs, posing a dual threat to corporate security and global economic stability.

What to watch

Companies are advised to rigorously verify applicant identities, locations, and qualifications, while restricting access to only necessary systems. Developers should avoid running unknown code outside sandboxes and inspect files for hidden payloads. Authorities may continue to dismantle 'laptop farms' and trace cryptocurrency flows to North Korea.