Japan Dismantles First North Korean Laptop Farm in WaterPlum Scheme

September 22, 2026 at 01:37 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Japan dismantled its first North Korean laptop farm as part of a joint advisory with the US, Australia, and Germany on the WaterPlum hacking group. The group infected at least 30,000 devices across more than 100 countries between December 2025 and July 2026. The operation stole funds or credentials from over 7,000 cryptocurrency wallets, with an estimated $10.71 million reaching North Korea.

Key Facts

Japan dismantled its first North Korean laptop farm in 2026, according to a joint advisory from Japan, the US, Australia, and Germany.
The WaterPlum group infected at least 30,000 devices across more than 100 countries between December 2025 and July 2026.
Funds or account credentials were stolen from more than 7,000 cryptocurrency wallets, with an estimated $10.71 million reaching North Korea.
WaterPlum operators and some North Korean IT workers are assessed to answer to the 313 General Bureau of the Munitions Industry Department under the Workers’ Party of Korea’s Central Committee.
Japanese authorities obtained evidence that the cyber actor group transferred several hundred million Japanese yen in cryptocurrency to foreign locations outside Japan.

WaterPlum Campaign Overview

WaterPlum poses as employers to reach software developers and IT professionals, often impersonating real AI, cryptocurrency, or NFT companies. The group has also used legitimate recruiting services to make contact, according to the advisory. Between December 2025 and July 2026, WaterPlum infected at least 30,000 devices across more than 100 countries. Primary targets were web designers, engineers, and specialists in cryptocurrency, blockchain, and web3. Funds or account credentials were taken from more than 7,000 cryptocurrency wallets, and the agencies estimate that roughly $10.71 million ultimately reached North Korea.

Japan's Laptop Farm Takedown

Part of the scheme relies on laptop farms: locations, often an accomplice’s residence, where devices are set up and then run remotely by North Korean IT workers. These accomplices also manage servers on the workers’ behalf, masking their real location while they carry out paid IT work. According to the advisory, Japan dismantled one such laptop farm this year, the first case of its kind the country has confirmed. Japanese authorities obtained evidence this cyber actor group transferred several hundred million Japanese yen in cryptocurrency to foreign locations outside of Japan. Separately, the FBI says it continues to identify and prosecute US-based individuals who provide facilitation services to North Korean IT workers.

Telltale Signs and Broader Impact

The advisory describes a case from a Japanese cryptocurrency exchange that turned down a suspicious applicant in May 2025. The government agencies noted that the damage does not stop at stolen wallets. A compromised developer can give WaterPlum a path into their employer’s network, and the group has also used stolen data for extortion or to access personal information and trade secrets.