aviatrix logoAviatrix
Under Active Attack

Executive Summary

Between December 2025 and July 2026, the North Korean hacking group WaterPlum executed a sophisticated supply chain attack through their "Contagious Interview" campaign, compromising over 30,000 devices across more than 100 countries. The attackers impersonated legitimate AI, cryptocurrency, and NFT companies to target job seekers with malicious npm packages and fake coding tests, ultimately stealing cryptocurrency credentials from over 7,000 wallets and transferring $10.7 million to North Korea. The operation combined social engineering with multiple malware families including BeaverTail, InvisibleFerret, and StoatWaffle to conduct financial theft and espionage.

This incident highlights the evolving sophistication of state-sponsored supply chain attacks that exploit trusted development environments and social engineering tactics, demonstrating how nation-state actors are increasingly targeting individual developers and IT professionals to fund weapons programs while simultaneously infiltrating corporate networks.

Why This Matters Now

Nation-state actors are increasingly weaponizing legitimate hiring processes and development tools to conduct supply chain attacks, making traditional perimeter defenses insufficient against sophisticated social engineering campaigns targeting remote workers and developers.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

WaterPlum attackers impersonated legitimate companies and used fake job interviews to trick developers into downloading malicious npm packages and executing code during supposed coding tests or troubleshooting sessions.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would have significantly constrained the WaterPlum campaign's lateral movement and data exfiltration capabilities through workload segmentation and controlled egress policies. The attack's blast radius across 30,000+ devices and employer networks could likely have been reduced through identity-aware access controls and east-west traffic enforcement.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Initial compromise through social engineering may still have succeeded, but the malware's ability to communicate with command infrastructure would likely be constrained by default-deny egress policies and application-aware traffic inspection.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Credential theft may have occurred locally, but the stolen authentication tokens would likely face restricted scope when attempting to access segmented cloud workloads and network resources beyond the immediate user context.

Lateral Movement

Control: East-West Traffic Security

Mitigation: Cross-network pivoting attempts would likely be significantly constrained through microsegmentation policies that inspect and control internal traffic flows between workloads, reducing the attackers' ability to expand their foothold across employer infrastructures.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Command and control communications would likely be constrained through comprehensive traffic visibility and policy enforcement across cloud environments, limiting the attackers' ability to maintain persistent remote access channels.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Data exfiltration volumes and destinations would likely be significantly constrained through egress traffic inspection and policy controls, reducing the scale of sensitive data transfer to external North Korean infrastructure.

Impact (Mitigations)

While some financial losses might still occur from initially compromised endpoints, the reduced lateral reach and constrained exfiltration paths would likely limit the total cryptocurrency theft below the $10.7 million achieved.

Impact at a Glance

Affected Business Functions

  • IT Development and Software Engineering
  • Cryptocurrency Trading and Digital Asset Management
  • Remote Work Infrastructure
  • Human Resources and Talent Acquisition
Operational Disruption

Estimated downtime: N/A

Financial Impact

Estimated loss: $10,700,000

Data Exposure

Compromise of over 7,000 cryptocurrency wallets with theft of private keys and seed phrases. Browser credentials, clipboard contents, keystroke logs, and sensitive documents from 30,000+ infected devices across IT professionals and developers. Potential intellectual property theft and corporate network access through lateral movement.

Recommended Actions

  • • Implement Zero Trust Segmentation with identity-based policies to prevent lateral movement from compromised developer workstations to critical enterprise networks and cryptocurrency infrastructure
  • • Deploy Egress Security & Policy Enforcement to block unauthorized outbound connections and detect cryptocurrency exfiltration attempts through FQDN filtering and data loss prevention controls
  • • Enable Multicloud Visibility & Control to monitor anomalous developer tool usage, detect suspicious automation patterns, and identify repeated malformed requests from compromised development environments
  • • Establish Threat Detection & Anomaly Response capabilities to baseline normal developer behavior and alert on covert remote access tools, unusual cryptocurrency wallet interactions, and credential harvesting activities
  • • Enforce East-West Traffic Security controls to inspect and control workload-to-workload communications, preventing compromise spread between development, staging, and production environments

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image