North Korean WaterPlum hackers infected 30,000 devices worldwide
North Korean threat actors are targeting job seekers with a fake Windows video conferencing application disguised as FreeConference.com. This follows a broader campaign by the WaterPlum group, which the FBI and Japan's National Police Agency report infected 7,000 cryptocurrency wallets across more than 100 countries. These actors use fake job offers and coding tests to deploy malware. Simultaneously, other North Korean groups like APT37 and PolinRider are deploying backdoors via fake security alerts and poisoning software packages across npm and the Chrome Web Store.
Listen to Live Briefing
Real-time synthesized voice briefing · Live Feeds Desk
- ✓ The FBI and Japan's National Police Agency state WaterPlum malware hit 7,000 crypto wallets via fake job offers.
- ✓ North Korean IT worker schemes target engineers' job-hunting activities.
- ✓ The US Department of Justice announced coordinated actions against DPRK government schemes to fund its regime through remote IT work for US companies.
What changed
Threat actors have expanded their tactics to include a fake FreeConference.com application targeting job seekers.
Live updates
-
North Korean Hackers Target Job Seekers via Fake Video Conferencing Apps
North Korean threat actors are targeting job seekers with a fake Windows video conferencing application disguised as FreeConference.com. This follows a broader campaign by the WaterPlum group, which the FBI and Japan's National Police Agency report infected 7,000 cryptocurrency wallets across more than 100 countries. These actors use fake job offers and coding tests to deploy malware. Simultaneously, other North Korean groups like APT37 and PolinRider are deploying backdoors via fake security alerts and poisoning software packages across npm and the Chrome Web Store.
Why it matters
The North Korean regime uses remote IT work and cyber theft to fund its government. These operations involve complex schemes including laptop farms to hide worker locations and specialized laundering networks to process stolen assets.
What is confirmed
- The FBI and Japan's National Police Agency state WaterPlum malware hit 7,000 crypto wallets via fake job offers.
- North Korean IT worker schemes target engineers' job-hunting activities.
- The US Department of Justice announced coordinated actions against DPRK government schemes to fund its regime through remote IT work for US companies.
Still unconfirmed
- A 8.9GB data leak from the Kimsuky APT exposed phishing logs and source code.
- North Korea logged 18,951 attempted cyberattacks on South Korea's military in 2025.
What to watch next
- Evidence of further malware distribution through the fake FreeConference.com application
- Official attribution of the PolinRider package poisoning to specific state organs
confidence 90%Sources used for this update (26)
- www.speedtest.net — Speedtest by Ookla - The Global Broadband Speed Test
- www.speedtest.net — Speedtest di Ookla - Il test globale per la velocità della tua...
- intelligence.speedtest.net — Speedtest Intelligence
- ciscoconnect.speedtest.net — Speedtest.net
- en.wikipedia.org — North - Wikipedia
- dictionary.cambridge.org — NORTH | English meaning - Cambridge Dictionary
- simple.wikipedia.org — North - Simple English Wikipedia, the free encyclopedia
- www.north.com — Payment processing companies, powered by North.
- www.north.com — Merchant services & payment technology powerhouse | North
- dailysecurityreview.com — North Korean Hackers Target Job Seekers with Fake ...
- note.com — [Explanation] Beware of North Korean Fake Companies ...
- dailysecurityreview.com — APT37 Deploys NarwhalRAT via Fake Microsoft Security Alerts
-
North Korean WaterPlum group used laptop farms to mask remote work and theft
North Korean hackers known as WaterPlum infected over 30,000 PCs and 7,000 cryptocurrency wallets across 100 countries to steal $10.7 million. The group targeted IT professionals through fake job interviews and coding tests using npm malware and VS Code tasks. Japanese police recently dismantled a laptop farm where North Korean IT workers remotely operated domestic hardware to hide their location and secure legitimate software development salaries from foreign companies. Seven intelligence and law enforcement agencies from the US, Japan, Australia, and Germany coordinated to expose these activities.
Why it matters
WaterPlum mimics legitimate employers in AI, NFT, and cryptocurrency sectors to distribute malware. The use of laptop farms allows the DPRK to generate foreign currency through both theft and legal remote employment. This hybrid approach complicates attribution by masking the attackers' actual geographic origin.
What is confirmed
- WaterPlum infected more than 30,000 PCs and 7,000 cryptocurrency wallets.
- The group used fake job tests, npm malware, and VS Code tasks to target IT professionals.
- Intelligence and law enforcement agencies from the US, Japan, Australia, and Germany issued a joint warning regarding WaterPlum.
- WaterPlum stole over 10 million dollars in cryptocurrency.
Still unconfirmed
- North Korean hackers are suspected in a $351 million Bitget heist.
- Japanese police found hundreds of millions of yen and crypto assets were transferred overseas via the laptop farm.
What to watch next
- Evidence linking WaterPlum to the Bitget heist
- Details on the number of foreign companies that hired North Korean workers via the laptop farm
confidence 90%Sources used for this update (5)
- cybersecuretoday.com — North Korea's WaterPlum Infected 30,000 Developer PCs With ...
- www.voanews.com — How North Korea turns job interviews into cyber traps
- finance.yahoo.com — North Korean hackers suspected in $351 million Bitget heist ...
- www.ithome.com.tw — 日本破獲境內北韓筆電農場，揭露北韓IT工作者遠端接案模式 | iThome
- latestincyber.substack.com — Cyberattack Sunday; Sep 20th - 26th, 2026
-
North Korean WaterPlum group stole $10.7 million via fake job interviews
North Korean hackers known as WaterPlum compromised at least 30,000 devices in more than 100 countries to steal $10.7 million from 7,000 cryptocurrency wallets. The group targeted IT professionals and software developers using fraudulent coding tests and job interviews. International law enforcement agencies from the US, Japan, Germany, and Australia coordinated to dismantle a laptop farm used by the attackers. Separately, MetaMask reported an ongoing security incident affecting its infrastructure on Thursday.
Why it matters
This campaign specifically targeted the Rust programming community, including crate owners and team members. The use of sophisticated social engineering and infrastructure highlights the evolving tactics of state-sponsored cybercrime.
What is confirmed
- WaterPlum compromised at least 30,000 devices across more than 100 countries.
- The group targeted software developers and IT professionals.
- The hackers stole $10.7 million from 7,000 cryptocurrency wallets.
- MetaMask disclosed an ongoing infrastructure security incident on Thursday.
Still unconfirmed
- North Korean hackers used deepfakes of their own faces to rob cryptocurrency developers.
What to watch next
- Confirmation of a link between the MetaMask infrastructure incident and WaterPlum activity.
- Further details from the Japan National Police Agency regarding the laptop farm dismantle.
confidence 90%Sources used for this update (3)
- www.bleepingcomputer.com — Metamask discloses security incident affecting its infrastructure - BleepingComputer
- www.ibtimes.com — North Korean Hackers Stole $10.7 Million In Crypto. Fake Job ...
- startupfortune.com — North Korean hackers deepfaked their own faces to rob crypto ...
-
North Korean WaterPlum hackers infect 30,000 devices, steal $10.7 million
North Korean hackers operating as WaterPlum infected 30,000 devices globally using fraudulent job interviews and coding tests, stealing $10.7 million from 7,000 cryptocurrency wallets across 100 countries. The campaign targeted IT developers, including Rust team members and crate owners. Law enforcement agencies from the US, Japan, Germany, and Australia issued joint warnings and dismantled a North Korean laptop farm.
Why it matters
This cyber espionage campaign highlights the growing threat of North Korean hacking groups targeting the global IT and cryptocurrency sectors. The use of fake job interviews and coding tests to compromise devices and steal sensitive information demonstrates the sophistication and adaptability of these hackers. The international response, including joint advisories and law enforcement actions, underscores the need for cooperation to combat these threats.
What is confirmed
- North Korean WaterPlum hackers infected 30,000 devices worldwide.
- The hackers stole $10.7 million from 7,000 cryptocurrency wallets.
- The campaign targeted IT developers, including Rust team members and crate owners.
- Law enforcement agencies from the US, Japan, Germany, and Australia issued joint warnings.
- The hackers used fraudulent job interviews and coding tests to compromise devices.
Still unconfirmed
- A North Korean hacking group stole $351.6 million from the Bitget crypto exchange.
What to watch next
- Further details on the dismantling of the North Korean laptop farm
- Additional information on the exploited zero-day flaw in third-party security products
- The response of cryptocurrency exchanges and developers to the WaterPlum campaign
confidence 95%Sources used for this update (12)
- www.escudodigital.com — North Korean hackers pose as tech recruiters, compromising ...
- www.bleepingcomputer.com — Hackers steal $351.6 million in Bitget crypto exchange hack - BleepingComputer
- www.coinlive.com — North Korean Hackers Use Fake Crypto Job Interviews To Infect 30,000 Devices And Steal $10.7 Million
- dailysecurityreview.com — North Korean WaterPlum Stole $10.7M After Infecting 30,000 ...
- www.technotime.net — Global Security Agencies Warn of North Korean Hackers ...
- shattered.io — WaterPlum Hackers Steal $10.7M From 7,000 Wallets
- aviatrix.ai — North Korean IT Worker Scams: WaterPlum Campaign Analysis 2025
- www.abc.net.au — North Korean group 'WaterPlum' steals millions in crypto hack
- www.bleepingcomputer.com — Bitget hacked via zero-day in third-party security products - BleepingComputer
- www.gate.com — North Korean Hackers Steal $10.7M in Crypto via Fake Job Scam
- www.paubox.com — North Korea's WaterPlum group infects 30,000 devices and ...
- guavy.com — North Korea's WaterPlum Hackers Steal $10.7M from 7,000 ...
-
WaterPlum Hackers Infect 30,000 Devices in Crypto Scheme
North Korean hackers operating under the WaterPlum group have compromised 30,000 devices globally using fraudulent job interviews and coding tests. The campaign targeted IT developers, including Rust team members and crate owners, draining up to $11 million from 7,000 cryptocurrency wallets across 100 countries such as Japan. Law enforcement agencies from the United States, Japan, Germany, and Australia responded by issuing joint warnings and dismantling a North Korean laptop farm. Authorities now caution that malicious coding assignments and video-conferencing fixes can expose both developer devices and employer networks.
Why it matters
The operation leverages remote IT worker schemes tied directly to Pyongyang. A seven-agency advisory connects these hacking activities to the same North Korean bureau. International police forces continue coordinated efforts to disrupt the infrastructure backing these widespread attacks.
What is confirmed
- North Korean hackers linked to the WaterPlum group compromised 30,000 devices worldwide through fraudulent job interviews and coding tests.
- The campaign drained up to $11 million from 7,000 cryptocurrency wallets across 100 countries, including Japan.
- A seven-agency advisory connects the WaterPlum hacking crew and Pyongyang's remote IT worker scheme to the same bureau.
What to watch next
- Further actions by the seven-agency advisory against North Korean IT worker infrastructure
- Additional international law enforcement raids on laptop farms
confidence 100%Sources used for this update (2)
- www.thestar.com.my — North Korean hackers posed as recruiters. They infected 30,000 devices worldwide
- www.yahoo.com — North Korea's Fake Job Interviews Drained $11M From 7,000 Crypto Wallets
-
North Korean Hackers Infect 30,000 Devices in Job Scam
North Korean hackers linked to the WaterPlum group have compromised 30,000 devices worldwide through fraudulent job interviews and coding tests targeting IT developers, including Rust team members and crate owners. The campaign drained up to $11 million from cryptocurrency wallets, taking funds or credentials from 7,000 wallets across 100 countries including Japan. The FBI and Japanese police have issued joint warnings about the operation, while Japanese authorities dismantled a North Korean laptop farm as part of an international law enforcement response involving the US, Germany, and Australia.
Why it matters
The operation relies on social engineering tactics where attackers pose as recruiters to trick technology professionals into video calls and technical assessments. Once engaged, the malicious actors deploy persistent remote access trojans and malware payloads during coding tests. This methodology highlights a growing trend of human infiltration and targeted supply chain attacks against software developers to harvest valuable digital assets.
What is confirmed
- North Korean WaterPlum hackers infected 30,000 devices worldwide.
- The WaterPlum group looted $10.7 million in cryptocurrency and planted persistent RATs.
- The campaign targeted IT developers, including Rust team members and popular crate owners, via video calls.
- The FBI and Japanese police issued warnings about North Korea-linked WaterPlum hackers targeting IT developers.
- Japan dismantled a North Korean laptop farm as part of a wider US, German, and Australian joint investigation.
Still unconfirmed
- Funds or credentials were taken from 7,000 crypto wallets.
What to watch next
- Further international arrests or enforcement actions against the WaterPlum infrastructure.
- Additional disclosures from the FBI, Japanese police, or allied agencies regarding the stolen crypto funds.
confidence 95%Sources used for this update (22)
- BleepingComputer — North Korean WaterPlum hackers infected 30,000 devices worldwide
- The Japan Times — North Korean hackers behind crypto thefts across 100 countries, including Japan
- The Register — North Korea's fake job interviews infected 30,000 devices
- Yahoo — Hackers Infect 30,000 Devices, Drain $11 Million From Crypto Wallets
- Binance — FBI and Japanese Police Warn of North Korea-Linked WaterPlum Hackers Targeting IT Developers
- inc.com — North Korean Hackers Posed as Recruiters. They Infected 30,000 Devices Worldwide
- CryptoRank — How Fake Job Offers Are Stealing Crypto Developers’ Wallet Data—and How to Spot Them
- Tom's Hardware — North Korea used job interviews to deploy malware on 30,000 devices during coding tests — WaterPlum group loots $10.7 million in crypto and plants persistent RATs
- Modern Tokyo Times — North Korea and Cyber Warfare (Lazarus Group and ByBit Hack – Lawsuit Filed)
- Barracuda Networks Blog — The fake worker threat and the rise of human infiltration
- 深潮TechFlow — Coding Interview = Stolen Wallet? North Korean Hacker Group WaterPlum’s Hiring Scam Exposed
- securityweek.com — Rust Team Members and Popular Crate Owners Targeted via Video Calls
Community Sentiment: How do you assess this situation?
Voice your perspective · Real-time aggregated sentiment from the Live Feeds community