Seven law enforcement and cybersecurity agencies from Japan, the United States, Australia, and Germany published a joint advisory on September 18 regarding the North Korean hacker group WaterPlum, also known as « Contagious Interview ». Over eight months, from December 2025 to July 2026, the group infected 30,000 devices, emptied more than 7,000 crypto wallets, and stole 10.71 million dollars destined for Pyongyang, targeting freelance developers through fake job interviews laced with malware such as BeaverTail, InvisibleFerret, or OtterCookie. The hackers posted fictitious job offers in the artificial intelligence or cryptocurrency sectors, instructing victims to download contaminated NPM packages to pass a technical test. Japanese police also dismantled for the first time on its soil a laptop farm, a remote-controlled portable computer facility used to operate North Korean IT workers. According to the FBI and the NPA, WaterPlum operates under the 313th Bureau of the General Machinery Industry Department, affiliated with the Workers’ Party of North Korea.
Source: Read the original article
