aviatrix logoAviatrix
Under Active Attack

Executive Summary

North Korean threat actors operating under WaterPlum (aka Contagious Interview) have compromised over 30,000 devices across 100+ countries by posing as legitimate AI, cryptocurrency, and NFT company recruiters targeting software developers and IT professionals. The campaign, linked to North Korea's 313 General Bureau, uses fake job opportunities to deliver malware and establish persistent access for cryptocurrency theft and data exfiltration. The operation has successfully stolen approximately $11 million in cryptocurrency from over 7,000 wallets while maintaining extensive overlap with broader North Korean IT worker infiltration efforts.

This incident highlights the evolution of North Korean cyber operations beyond traditional state-sponsored espionage toward systematic financial crime integrated with legitimate IT workforce infiltration, representing a new paradigm where threat actors blend cybercriminal activities with long-term economic penetration strategies.

Why This Matters Now

The convergence of social engineering, cryptocurrency theft, and workforce infiltration demonstrates how nation-state actors are adapting to remote work environments, making traditional perimeter security insufficient against threats that exploit human trust and legitimate business processes.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

WaterPlum actors impersonated legitimate AI, cryptocurrency, and NFT companies to contact software developers with attractive job opportunities, then delivered malware during the fake interview process to gain initial access and establish persistence.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would likely have constrained the WaterPlum campaign's massive lateral spread and cryptocurrency theft by implementing workload segmentation and controlled egress paths. The attack's ability to compromise over 30,000 devices across corporate networks would likely have been significantly reduced through east-west traffic enforcement and identity-aware access controls.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: While initial compromise through social engineering may still occur, workload isolation would likely limit the attacker's ability to establish widespread persistent access across cloud and hybrid environments immediately after initial infection.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero trust segmentation would likely constrain privilege escalation attempts by limiting administrative access paths and reducing the scope of elevated permissions available to compromised accounts within segmented network zones.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic enforcement would likely significantly reduce the attacker's ability to move laterally across network segments, constraining their reach from the initial 30,000 compromised devices to a much smaller subset of accessible systems.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility and control would likely detect and constrain persistent C2 communications by identifying suspicious outbound traffic patterns and blocking unauthorized connections to known malicious infrastructure across cloud environments.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security controls would likely constrain large-scale cryptocurrency transfers by detecting and blocking suspicious outbound financial transactions, significantly reducing the volume of funds that could be exfiltrated to external accounts.

Impact (Mitigations)

While some cryptocurrency theft may still occur from initially compromised systems, the overall financial impact would likely be substantially reduced due to constrained lateral reach and limited access to the full scope of targeted cryptocurrency infrastructure.

Impact at a Glance

Affected Business Functions

  • Cryptocurrency Trading and Exchange Operations
  • Software Development and IT Services
  • Digital Asset Management
  • Blockchain and NFT Platform Operations
Operational Disruption

Estimated downtime: 7 days

Financial Impact

Estimated loss: $11,000,000

Data Exposure

Compromised credentials and authentication data from over 30,000 devices across 100+ countries. Stolen cryptocurrency wallet private keys and seed phrases from approximately 7,000 crypto wallets. Potential exposure of proprietary source code, development projects, and intellectual property from targeted IT professionals and software developers. Personal and professional information of job seekers in AI, cryptocurrency, and NFT industries.

Recommended Actions

  • • Implement Zero Trust segmentation to prevent lateral movement between compromised endpoints and cryptocurrency infrastructure
  • • Deploy egress security controls with FQDN filtering to block unauthorized cryptocurrency transfers and data exfiltration to foreign destinations
  • • Enable multicloud visibility and anomaly detection to identify suspicious automation patterns and repeated malformed requests from compromised devices
  • • Establish encrypted traffic inspection capabilities to detect covert command and control communications through HPE and inline IPS
  • • Implement threat detection and anomaly response systems to baseline normal behavior and alert on remote access tools like AnyDesk used by North Korean actors

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image