Law enforcement agencies from six nations, including Japan's National Police Agency and the U.S. Federal Bureau of Investigation, disclosed a coordinated cyberattack campaign in which North Korean hackers targeted software developers, web designers, and cryptocurrency specialists through fraudulent job recruitment channels.
The threat actor, known as "Waterplum" or "Contagious Interview," impersonated recruiters from legitimate technology and blockchain companies on job platforms and social media. During fake technical interviews and coding assessments, targets were instructed to download software presented as coding tests or video conferencing tools. The downloads delivered backdoor trojans and information-stealing malware that harvested personal identification documents and cryptocurrency private keys.
Between late 2025 and July 2026, the campaign compromised at least 30,000 devices worldwide. The breach affected more than 7,000 cryptocurrency wallets and resulted in the theft of at least 1.7 billion yen, equivalent to $10.71 million, according to officials.
Authorities assessed that Waterplum operates under the direct oversight of Bureau 313 of the Munitions Industry Department of the Workers' Party of Korea, which manages the country's military research and weapons production.
Laptop Farms Enable Remote Operations
The investigation revealed that "domestic enablers" assisted North Korean operatives in bypassing location verification systems to obtain outsourced IT jobs at Japanese and U.S. firms. Japanese law enforcement seized and dismantled a local "laptop farm" that permitted remote North Korean IT workers to operate under local IP addresses.
Security Recommendations
International security agencies have urged technology companies and gig workers to take precautions during online interviews. Recommended measures include:
- Avoiding execution of unvetted code outside isolated sandbox environments
- Utilizing workspace restriction controls when opening untrusted code repositories
- Exercising caution during online technical interviews with unfamiliar recruiters
