NewsPublished 22 Sep 2026

Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme

Source SecurityWeek

Description

A joint advisory from the US, Japan, Germany, and Australia details the North Korean WaterPlum campaign, which uses a hiring scheme to target software developers and IT professionals globally. WaterPlum impersonates legitimate companies and recruiting services to infect devices and steal cryptocurrency funds. Japan dismantled its first North Korean laptop farm used to remotely operate infected devices. The campaign has compromised over 30,000 devices in more than 100 countries, stealing funds from over 7,000 cryptocurrency wallets. The group is linked to North Korea's 313 General Bureau and uses sophisticated evasion techniques including AI face-swapping during interviews. The campaign poses risks beyond theft, including potential network infiltration and extortion.

Impact

WaterPlum has infected at least 30,000 devices across over 100 countries, stealing funds from more than 7,000 cryptocurrency wallets, with an estimated $10.71 million transferred to North Korea. Beyond financial theft, compromised developers may provide attackers access to their employers' networks, risking exposure of trade secrets and personal data. The campaign's use of laptop farms enables remote operation and obfuscation of attacker locations. The takedown of a laptop farm in Japan marks a significant disruption of the group's infrastructure. The campaign's sophisticated evasion techniques complicate detection and attribution.

Defensive guidance

Organizations should be aware of WaterPlum's tactics, including impersonation of legitimate companies and use of AI-based deception during recruitment. Vigilance in verifying candidate identities and behaviors during hiring processes is recommended. Cryptocurrency exchanges and wallet holders should monitor for suspicious activity and employ strong security controls. Law enforcement actions, such as Japan's dismantling of laptop farms, contribute to disruption. Follow updates from official advisories for ongoing mitigation guidance.

Summary

The WaterPlum campaign is a North Korean cyber operation that targets IT professionals worldwide by posing as legitimate employers, often in AI, cryptocurrency, or NFT sectors. It uses social engineering and malware to infect devices, resulting in theft of cryptocurrency funds totaling approximately $10.71 million. The campaign operates laptop farms—remote device clusters managed by North Korean IT workers via accomplices—to mask their activities. Japan has dismantled its first known laptop farm linked to this group. The advisory highlights the group's ties to North Korea's 313 General Bureau and describes their use of AI face-swapping and other deception techniques during recruitment interviews. The campaign also threatens victim organizations through potential network access and extortion.

References

securityweek.com/japan-dismantles-first-north-korean-laptop-farm-as-us-and-allies-detail-wider-scheme/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Sep 2026, 08:47 UTC

References

Community reviews