US, Japan, Germany, Australia warn North Korean hackers stole $11 million via fake job interviews

September 18, 2026 at 08:48 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

North Korean hacking group WaterPlum infected more than 30,000 devices in over 100 countries by posing as recruiters for AI and crypto firms, US and allied agencies said Friday. The group stole nearly $11 million in cryptocurrency from over 7,000 wallets. The alert links WaterPlum to North Korea's 313 General Bureau and notes overlap with North Korean IT workers.

Key Facts

WaterPlum infected more than 30,000 devices in over 100 countries, targeting IT professionals in Japan, the US, and Europe.
The group transferred nearly $11 million in cryptocurrency from over 7,000 wallets to North Korea.
WaterPlum operates under the 313 General Bureau of the Munitions Industry Department, subordinate to the Central Committee of the Workers Party of Korea.
Japanese authorities dismantled a laptop farm operated by an enabler in Japan for the first time.
The malware used includes BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle.

Attack Method

WaterPlum operators pose as prospective employers to target software developers and IT professionals worldwide under the pretext of attractive job opportunities. They often impersonate legitimate AI, cryptocurrency, or NFT companies and have also used recruiting services. During the supposed interview process, victims are instructed to download files presented as coding assignments or other recruitment tests. Opening them backdoors the applicants' computers and installs malware, including remote access trojans and information stealers. The malware steals browser data, private keys, seed phrases, and identity documents.

Overlap with IT Workers

Some WaterPlum actors also operate as North Korean IT workers performing web system design and development tasks on corporate web systems for clients. WaterPlum actors and North Korean IT workers used the same IP addresses when accessing laptop farms, using cloud-sourcing services, and applying for positions at a Japanese cryptocurrency exchange. The overlap between WaterPlum and North Korean IT workers is substantial, according to the agencies. In some cases, compromised machines may later provide a route into corporate systems when jobseekers secure legitimate employment.

Law Enforcement Response

For the first time in Japan, authorities successfully identified, investigated, and dismantled a laptop farm operated by an enabler in Japan. Japanese authorities obtained evidence that this cyber actor group transferred several hundred million Japanese yen in cryptocurrency to foreign locations outside of Japan. The FBI continues to identify and prosecute US-based actors providing illicit facilitation services to North Korean IT workers. The advisory lists indicators of suspicious applicants, including refusal of in-person meetings, requests for salary in cryptocurrency, and video or audio glitches during interviews.