Threat ActorPublished 19 Sep 2026

North Korean WaterPlum hackers infected 30,000 devices worldwide

Source Bleeping Computer

Description

The North Korean hacking group WaterPlum has compromised at least 30,000 devices worldwide between December 2025 and July 2026, stealing over $10.7 million in cryptocurrency. WaterPlum uses malicious npm packages and fake job interviews to infect victims with malware that steals credentials, cryptocurrency keys, and sensitive data. The group is linked to North Korea's 313 General Bureau, supporting the regime's weapons programs. WaterPlum also impersonates victims to obtain jobs and expand attacks to espionage. Law enforcement agencies from Japan, the US, Australia, and Germany jointly issued this advisory.

Impact

WaterPlum's operations have resulted in the compromise of at least 30,000 devices globally, theft of credentials and cryptocurrency private keys from over 7,000 wallets, and the transfer of approximately $10.7 million in stolen cryptocurrency to North Korea. The malware enables extensive data theft, including sensitive documents and keystrokes, and facilitates lateral movement into employer or client networks, potentially leading to intellectual property theft and espionage. The group's activities support North Korea's weapons programs by generating revenue through cybercrime.

Defensive guidance

The advisory recommends companies carefully verify job applicants' identities, locations, and qualifications, and restrict their access to only necessary systems and data. Developers should avoid running unknown code outside sandboxed environments and thoroughly inspect files and code for commands that fetch additional payloads. There is no indication that the threat is mitigated or patched; organizations should apply these operational security measures to reduce risk.

Summary

WaterPlum is a North Korean threat actor linked to a multi-year campaign called "Contagious Interview," which targets job seekers via malicious npm packages and fake interviews. The group infected at least 30,000 devices in over 100 countries and stole funds from more than 7,000 cryptocurrency wallets, transferring approximately $10.7 million to North Korea. WaterPlum uses several malware families, including BeaverTail (JavaScript malware in npm packages), InvisibleFerret (Python backdoor), OtterCookie (JavaScript RAT and info stealer), OtterCandy (combined RAT), and StoatWaffle (modular Node.js malware). The malware steals browser credentials, clipboard data, keystrokes, cryptocurrency private keys, seed phrases, and documents, and captures screenshots. WaterPlum actors also pivot to employer or client networks for intellectual property theft and espionage. The group is connected to North Korean IT workers who perform remote web development and reuse stolen identities. The FBI and Japanese police attribute WaterPlum operations to North Korea's 313 General Bureau under the Munitions Industry Department.

References

bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 19 Sep 2026, 14:16 UTC

References

Community reviews