North Korean WaterPlum Campaign: How Fake AI Job Offers Led to $11M Cryptocurrency Heist
North Korean threat actors operating under WaterPlum (aka Contagious Interview) have compromised over 30,000 devices across 100+ countries by posing as legitimate AI, cryptocurrency, and NFT company recruiters targeting software developers and IT professionals. The campaign, linked to North Korea's 313 General Bureau, uses fake job opportunities to deliver malware and establish persistent access for cryptocurrency theft and data exfiltration. The operation has successfully stolen approximately $11 million in cryptocurrency from over 7,000 wallets while maintaining extensive overlap with broader North Korean IT worker infiltration efforts. This incident highlights the evolution of North Korean cyber operations beyond traditional state-sponsored espionage toward systematic financial crime integrated with legitimate IT workforce infiltration, representing a new paradigm where threat actors blend cybercriminal activities with long-term economic penetration strategies.
Kill Chain
