Agencies from the United States, Japan, Australia and Germany issued a joint warning on Friday about WaterPlum, a North Korean crew that poses as recruiters and backdoors the developers it interviews.
The playbook is a fake hiring process. Applicants are sent files described as coding assignments or recruitment tests. Opening one installs malware and hands the operators remote access trojans and information stealers, along with lasting access to credentials, keystrokes and identity documents.
The numbers in the advisory are blunt. More than 30,000 devices infected across more than 100 countries. Roughly 7,000 cryptocurrency wallets drained. At least $10.71 million taken and funnelled toward Pyongyang.
One campaign, two incomes
Two details make WaterPlum harder to dismiss. The agencies tie the group to the 313 General Bureau of the Munitions Industry Department and find substantial overlap with North Korea’s IT worker programme, including shared IP addresses used to reach laptop farms. And a compromised personal machine can become a route into an employer’s network once the applicant is hired.
Japanese authorities dismantled a laptop farm inside the country, the first such takedown, and recovered evidence of payments routed abroad. The panel overseeing UN sanctions separately reported thousands of North Korean nationals holding jobs worldwide.
For hiring and security teams, the warning signs are behavioural rather than technical: refusing to meet in person, cameras switched off shortly after a call begins, background voices, payment demanded in cryptocurrency. Any organisation that suspects it has engaged one of these workers should assume credentials and sensitive data are already gone and start a forensic review.
