A joint advisory from Japan, the United States, Australia, and Germany attributes the WaterPlum, or Contagious Interview, operation to a North Korean scheme that impersonated companies to recruit developers and IT professionals. The campaign infected at least 30,000 devices in more than 100 countries, stole funds from over 7,000 cryptocurrency wallets, and included Japan’s first confirmed takedown of a North Korean laptop farm. #WaterPlum #ContagiousInterview #NorthKorea #JapanFBI #313GeneralBureau
Keypoints
- WaterPlum posed as AI, crypto, and NFT employers to target software and IT talent.
- The campaign infected at least 30,000 devices across more than 100 countries.
- More than 7,000 cryptocurrency wallets were compromised, sending about $10.71 million to North Korea.
- Japan dismantled its first confirmed North Korean laptop farm linked to the scheme.
- Investigators found signs such as VPN use, face-swapping, fake credentials, and reluctance to meet in person.