Police and judicial authorities, as well as security agencies in Japan, the U.S., and other countries, have issued an urgent advisory regarding the North Korean cyberattack group “WaterPlum” (commonly known as “Contagious Interview”) targeting IT professionals and engineers during their job hunts, as well as fake IT worker schemes. This comes amid an intensification of systematic operations aimed at stealing cryptocurrency, acquiring state-level foreign currency, and illegally obtaining confidential information by infecting systems with malware through fake job interviews and bogus companies.

Section 1-1: The Emergence of Fake Companies Targeting Job Seekers and the Scale of Damage

On September 18, 2026, multilateral investigative agencies—including the Japanese National Police Agency and National Cyber Directorate, the US FBI and Department of Defense Cyber Crime Center (DC3), Australia’s ASD, and Germany’s BND—jointly issued an urgent security advisory regarding “WaterPlum” (also known as Contagious Interview), a North Korean cyberattack group targeting engineers and job seekers. This group impersonates real or fictitious artificial intelligence (AI), cryptocurrency, and NFT-related companies, approaching IT freelancers and software developers with what appears to be lucrative job offers. When job seekers apply for the selection process, the group tricks them into downloading malicious programs under the guise of technical tests or interview troubleshooting, thereby infecting their computers with viruses. According to announcements by the National Police Agency and other authorities, at least 30,000 devices were compromised across more than 100 countries worldwide between December 2025 and July 2026 alone. Furthermore, it has been confirmed that private keys and authentication credentials were stolen from over 7,000 cryptocurrency wallets, and cryptocurrency equivalent to at least 1.7 billion yen (approx. $10.71 million) was illicitly transferred to North Korea. Please also refer to the conceptual diagram below for an overview of the damage situation.

Section 1-2: Malware Infection Tactics Exploiting the Hiring Process

To lower the guard of job seekers, threat actor groups skillfully utilize social media, freelance crowdsourcing sites, and job platforms. In the early stages of the recruitment process, they require online technical interviews and assignment submissions, during which they trick victims into downloading malicious files hosted on developer platforms such as GitHub and Bitbucket. Specifically, they embed malware such as “BeaverTail,” “InvisibleFerret,” “OtterCookie,” and “StoatWaffle” within Node Package Manager (NPM) packages used in JavaScript environments. For example, StoatWaffle exploits Visual Studio Code project settings to create a mechanism where code is automatically executed simply by opening a folder. Once these are executed, remote access tools (RATs) and infostealers establish persistence, and various login passwords saved in browsers, keystroke histories, cryptocurrency wallet seed phrases, and image data of passports and driver’s licenses are transmitted to C2 servers. Furthermore, the attack progresses to secondary damage, where the threat actors pivot through the infected engineer’s device to infiltrate the internal networks of their employer or clients, stealing confidential information and technical data.

Organizational Affiliations and the Mechanism of Illicit Revenue Generation

Section 2-1: The Operation Structure of the 313 Central Directorate and Laptop Farms

According to an analysis by multinational investigative agencies, WaterPlum members carrying out cyberattacks and remote IT workers are assessed to be operating systematically under the command of the “313 Bureau,” which falls under the Munitions Industry Department of the Workers’ Party of Korea. To secure funds for their country’s nuclear and missile development, they generate an estimated $250 million to $600 million (approx. 37 billion to 90 billion yen) in foreign currency annually. The core method behind this is a concealment tactic known as a “Laptop Farm.” This mechanism involves placing company-issued laptops in the homes or bases of collaborators (enablers) in countries such as Japan and the United States, allowing overseas IT workers to operate them remotely via VPNs or remote desktops. The actual IT workers reside in North Korea, as well as China, Russia, Southeast Asia, Africa, and elsewhere, masking direct access from their local regions to pose as Americans or Japanese. Additionally, there have been reports of cases where facial photographs are processed using generative AI-powered deepfake technology, and stolen IDs of real individuals are used to pass online interviews. In July 2024, an incident occurred where a fake engineer attempted to infiltrate the security firm KnowBe4, executing malware immediately after receiving the PC. Please refer to the following architectural diagram for the physical configuration of the laptop farm and the flow of remote operations.

Section 2-2: Large-scale Crackdowns by the U.S. Department of Justice and Other Authorities, and Legal Risks

Judicial and police authorities in various countries are intensifying raids and legal sanctions against illegal foreign currency acquisition schemes by North Korea. On June 30, 2025, the U.S. Department of Justice (DOJ) announced a coordinated investigation spanning 16 states nationwide, raiding 21 laptop farms and seizing a total of 137 computers. In this investigation, 29 financial accounts were frozen and 21 fraudulent websites were shut down, and a group that illicitly generated over $5 million in revenue from more than 100 U.S. companies alongside accomplices in China and Taiwan was indicted. Additionally, four North Korean nationals who stole $900,000 worth of cryptocurrency from a Georgia blockchain company have been criminally charged. Within Japan, in April 2025, the Public Security Bureau of the Tokyo Metropolitan Police Department cracked down on domestic accomplices who aided and abetted identity spoofing, and successfully dismantled a laptop farm that was illicitly transferring hundreds of millions of yen worth of cryptocurrency overseas. Based on UN Security Council Resolution 2397, paying remuneration to North Korean workers or outsourcing work to them not only violates international sanctions, but also carries the legal risk of severe civil and criminal penalties for violations of U.S. Treasury Department OFAC regulations and domestic laws (such as the Foreign Exchange and Foreign Trade Act).

Defensive Measures to be Taken by Corporations and Individuals, and Future Outlook

Section 3-1: Risk Mitigation Strategies in Hiring Interviews and Code Execution

To prevent malware infections by fake companies and the infiltration of fake IT workers, strict verification processes are required for both companies and individual engineers. Engineers who are job hunting must not carelessly execute unknown programs or scripts provided during the recruitment selection stage on their own PCs. In particular, the execution of files containing commands such as curl, base64, mshta, and Invoke-WebRequest, as well as encrypted or obfuscated code, should be avoided. If it is necessary to check test code, it is recommended to use an isolated virtual environment (sandbox) disconnected from the internet or Visual Studio Code’s “Restricted Mode” to prevent the automatic execution of tasks. On the other hand, for companies hiring or commissioning engineers, it is important not to rely solely on document screening or video interviews, but to implement multi-factor identity verification (such as biometric authentication or presentation of original identification documents). If candidates ask to turn off their cameras during interviews, respond while frequently glancing at the screen, or specify cryptocurrency or third-party accounts for compensation payments, these should be regarded as major warning signals (red flags).

Section 3-2: The Malicious Use of AI Technology and the Future of Cybersecurity

According to CrowdStrike’s “2026 Financial Services Threat Landscape Report,” the total amount of cryptocurrency stolen by North Korea-linked threat actors reached an estimated $2.02 billion (approximately 300 billion yen) in 2025 alone, representing a 51% increase year-over-year. Behind this trend is the reality that attackers are systematically integrating generative AI and large language models (LLMs) to dramatically improve the precision of their social engineering. North Korean cyber groups such as Famous Chollima are using AI to create highly natural fake resumes, social media profiles, and AI-generated voice and video, skillfully evading traditional detection methods. Furthermore, attackers are leveraging AI to drastically shorten the time required from initial intrusion to data exfiltration and funds theft. In future cybersecurity, rather than relying on a single security measure, it is essential to enforce strict access control based on Zero Trust principles, implement continuous log monitoring (via EDR), and build a real-time threat detection system utilizing AI technology.

Reference Page

• [National Police Agency: Advisory Regarding North Korean IT Workers, etc.] https://www.npa.go.jp/bureau/security/northkorea_IT/NK_IT_202607.html
• [U.S. Department of Justice: Announcement of Crackdown on North Korean Remote IT Worker Illicit Revenue Scheme] https://www.justice.gov/opa/pr/justice-department-announces-coordinated-nationwide-actions-combat-north-korean-remote
• [U.S. Department of the Treasury OFAC: Guidance on North Korean IT Workers] https://ofac.treasury.gov/media/923131/download?inline
• [FBI IC3: Security Alert on Data Extortion by North Korean IT Workers] https://www.ic3.gov/PSA/2025/PSA250123

【#Cybersecurity #NorthKorea #WaterPlum #ITEngineers #CryptoAssets #SocialEngineering #JobHunting #InformationSecurity】