WaterPlum North Korean Group Targeting IT Professionals

The North Korean cyber group WaterPlum (also known as 'Contagious Interview') has infected over 30,000 devices across 100 countries, stealing approximately 1.7 billion JPY in cryptocurrency. Operating under the 313 General Bureau of the Munitions Industry Department, the group targets software developers and IT professionals by posing as recruiters for AI and cryptocurrency firms.

The attack chain typically begins with social engineering on professional networking sites, leading to technical interviews where victims are coerced into downloading malicious code or collaborative development projects. Beyond direct financial theft, the group utilizes international 'laptop farms' to infiltrate corporate environments, leveraging stolen identities and remote access to generate revenue and conduct espionage.

This campaign represents a critical risk to the technology and financial sectors, as it bypasses traditional perimeter defenses by compromising the personal and development devices of trusted employees and contractors.