Joint advisory pins WaterPlum's fake recruiters to North Korea's 313 General Bureau
Four governments have put a bureau name on the fake-recruiter campaign against software developers, and their alert says the same crews also work as North Korea's remote IT hires, from the same IP addresses.
The Watch · Security desk
What happened
- A joint advisory attributes the group tracked as WaterPlum, or Contagious Interview, to the 313 General Bureau of the Munitions Industry Department, subordinate to the Workers Party of Korea's Central Committee.
- CyberScoop reports the group has infiltrated tens of thousands of job seekers' computer networks by posing as prospective employers, including artificial intelligence firms.
- The agencies count more than 30,000 infected devices across more than 100 countries, with IT professionals in Japan, the United States and Europe among the targets.
- Nearly $11 million equivalent in cryptocurrency has moved from more than 7,000 wallets to North Korea, according to the alert.
Why it matters
- Who's exposed exposure Recruitment contact is now a documented intrusion path into software developers and IT staff. A job approach to an engineer is not traffic most security teams inspect, and it reaches people who hold production credentials.
- Who has to decide decision Candidate vetting and threat hunting are looking at one set of IP addresses, so companies that run remote hiring and endpoint defence as separate programs are splitting a single problem across two budgets.
- What it limits constraint At under $1,600 per wallet, no individual theft is large enough to pull an investigator, so anything that catches this has to work on the endpoint or in the hiring channel before the money moves.
- What it sets up precedent Prosecution is landing on the local facilitator. Laptop farm hosts in other countries are the next people who can expect charges.
Next story · Security · 3d ago
DOJ seizes 187 laptops in raids on more than 40 Texas homes tied to North Korean IT workersConfirmed17 publishers
The same operators sit on both sides of a hiring process. "Some WaterPlum actors also operate as North Korean IT workers performing web system design and development tasks on corporate web systems for clients," the agencies wrote [6]. They also placed the two programs on shared infrastructure: "WaterPlum actors and North Korean IT Workers used the same IP addresses when accessing laptop farms, using cloud-sourcing services, and applying for positions at the Japanese cryptocurrency exchange" [7]. The overlap is substantial, the agencies said, and stolen information fed other operations [13].
The pretext is a job offer. "WaterPlum actors pose as prospective employers to target software developers and IT professionals worldwide under the pretext of attractive job opportunities," the alert said [4]. "They often impersonate legitimate Artificial Intelligence (AI), cryptocurrency, or Non-Fungible Token (NFT) companies and have also used recruiting services" [5]. CyberScoop, in its account of the alert, did not name the malware families. The agencies said they had some success against the group, released its tactics, techniques and procedures, and are seeking further cooperation [15].
Averaged out, each drained wallet gave up a little under $1,600 [18]. Losses that size rarely produce a police report on their own. The eleven-million-dollar figure exists because agencies in four countries added them together [9].
Those four are Japan, Australia, Germany and the United States, where both the FBI and the Defense Department's Cyber Crime Center signed [3][16]. What the alert adds to what was already public about Contagious Interview is a named military-industrial bureau where the record had a tracking label [2].
Enforcement so far has landed on the enablers. "For the first time in Japan, authorities successfully identified, investigated, and dismantled a 'laptop farm' operated by an enabler in Japan," the alert said [10]. Japanese authorities obtained evidence that the group moved several hundred million yen in cryptocurrency to locations outside Japan [11]. The FBI said it continues to identify and prosecute US-based actors providing illicit facilitation services to North Korean IT workers [14]. Separately, the Multilateral Sanctions Monitoring Team, the panel overseeing UN sanctions on North Korea, published a report on thousands of North Korean nationals employed in industries around the world [17].
For a company hiring remote developers, the two programs converge at one point: the candidate pipeline. One set of applicants is trying to get hired. Another set is trying to get a developer to run something during the interview [4][6].
What to watch
- Whether Japanese prosecutors bring further cases against enablers after the first laptop farm dismantlement, and whether they name the recruiting services used.
- Whether sanctions designations follow now that four governments have named the 313 General Bureau of the Munitions Industry Department.
- Whether the Multilateral Sanctions Monitoring Team's next report names the employers that hired North Korean nationals.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+5
- Incentives40
- Confidence72
Perspective Coverage
8 publishers- Builder
- Builder 34%
- Operator
- Operator 52%
- Investor
- Investor 14%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
US and allied governments warned Friday that North Korean hackers are infiltrating job seekers' computer networks by posing as prospective employers, such as artificial intelligence firms, to steal sensitive information and millions of dollars worth of cryptocurrency.
- [2]
The agencies behind the alert attributed the group known as WaterPlum or Contagious Interview to the 313 General Bureau of the Munitions Industry Department, subordinate to the Central Committee of the Workers Party of Korea.
- [3]
The alert came from agencies in Japan, Australia and Germany, alongside the FBI and the Department of Defense's Cyber Crime Center.
- [4]
"WaterPlum actors pose as prospective employers to target software developers and IT professionals worldwide under the pretext of attractive job opportunities," the agencies wrote.
- [5]
"They often impersonate legitimate Artificial Intelligence (AI), cryptocurrency, or Non-Fungible Token (NFT) companies and have also used recruiting services," the agencies wrote.
- [6]
"Some WaterPlum actors also operate as North Korean IT workers performing web system design and development tasks on corporate web systems for clients," read the alert.
- [7]
"WaterPlum actors and North Korean IT Workers used the same IP addresses when accessing laptop farms, using cloud-sourcing services, and applying for positions at the Japanese cryptocurrency exchange," the agencies wrote.
- [8]
Collectively, WaterPlum has infected more than 30,000 devices in more than 100 countries, targeting IT professionals in Japan, the United States, Europe and other nations.
- [9]
WaterPlum operations have transferred the equivalent of nearly $11 million of cryptocurrency from over 7,000 crypto wallets to North Korea, according to the alert.
- [10]
"For the first time in Japan, authorities successfully identified, investigated, and dismantled a 'laptop farm' operated by an enabler in Japan," the alert reads.
- [11]
Japanese authorities obtained evidence that the cyber actor group transferred several hundred million Japanese yen in cryptocurrency to foreign locations outside of Japan.
- [12]
CyberScoop reported that North Korean hackers are infiltrating tens of thousands of job seekers' computer networks by posing as prospective employers.
- [13]
The agencies said the actors used stolen information to fuel other operations and that the overlap between WaterPlum and North Korean IT workers is substantial.
- [14]
The FBI continues to identify and prosecute US-based actors providing illicit facilitation services to North Korean IT workers, according to the alert.
- [15]
The law enforcement agencies said they have had some success tackling the group but are seeking further cooperation, and released details in the alert about WaterPlum's tactics, techniques and procedures.
- [16]
Agencies from four countries signed the alert: Japan, Australia, Germany and the United States, which contributed two agencies.
- [17]
The Multilateral Sanctions Monitoring Team, an international panel overseeing UN sanctions against North Korea, released a report exposing thousands of North Korean nationals employed in industries around the world.
- [18]
Nearly $11 million taken from more than 7,000 wallets works out to an average under $1,600 per wallet.
Sources
8 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comNorth Korean WaterPlum hackers infected 30,000 devices worldwide
1 article · September 19, 2026
- cyberscoop.comInternational security agencies warn about North Korean hackers exploiting job seekers to steal crypto, data
1 article · September 18, 2026
- infosecurity-magazine.comNorth Korean Attackers Hit 30,000 Devices and Steal $10.7m
1 article · September 22, 2026
- securityaffairs.comContagious Interview: 30,000 devices infected by a fake job interview
1 article · September 21, 2026
- securityweek.comJapan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme
1 article · September 22, 2026
- thecyberexpress.comFour Countries Attribute “Contagious Interview” Fake-Job Malware Campaign to North Korea’s WaterPlum
2 articles · September 20, 2026
- thehackernews.comContagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto
1 article · September 21, 2026
- therecord.mediaNorth Korean hackers infect thousands of devices across 100 countries as part of ‘WaterPlum’ campaign
1 article · September 17, 2026
Topics and entities
Topics
- Software Supply Chain Security
- Laptop farms
- North Korean IT workers
- Fake-recruiter malware campaigns
- North Korean Cyber Operations
Entities
- WaterPlum
- Bundesnachrichtendienst
- Multilateral Sanctions Monitoring Team
- npm registry
- Federal Bureau of Investigation
- National Police Agency (Japan)
- Australian Cyber Security Centre
- Department of Defense Cyber Crime Center
- BeaverTail
- Visual Studio Code
- 313 General Bureau