Joint advisory on WaterPlum: 30,000 devices, $10.7M diverted

Figures put on the record by four countries

On 19 September 2026, Bleeping Computer reported on a joint advisory from Japanese, US, Australian and German authorities devoted to the North Korean group WaterPlum. The count covers December 2025 to July 2026: at least 30,000 infected devices across more than 100 countries, funds or credentials exfiltrated from more than 7,000 cryptocurrency wallets, and 1.7 billion yen — $10.71 million — in assets transferred to North Korea.

Those numbers come from a single document, the joint advisory itself, and we have only read Bleeping Computer’s account of it. They reflect what the four authorities were able to trace, not necessarily the true scale of the campaign.

Recruitment as the vector

WaterPlum is tied to a multi-year campaign known as “Contagious Interview”, already documented for targeting job seekers through malicious npm packages. The method described in the advisory is a piece of staging: the attackers pose as AI, cryptocurrency or NFT companies, or work through recruitment and freelance platforms. During a fake interview or technical test, the victim is asked to download a project, troubleshoot a supposed video-conferencing problem, or run code they have been given.

The advisory also notes the use of AI face-swapping software during online interviews, with the interviewers then switching off their cameras and blaming a network problem.

Five malware families, one harvest

The advisory links several families to these operations: BeaverTail, JavaScript hidden inside npm packages; InvisibleFerret, a Python backdoor; OtterCookie, a JavaScript remote access trojan and infostealer; OtterCandy, which combines the two; and StoatWaffle, modular Node.js code delivered through booby-trapped Visual Studio Code projects, whose configuration files run as soon as the folder is opened and trusted.

Once a machine is compromised, the collection is broad: credentials stored in the browser, clipboard contents, keystrokes, private keys and recovery phrases, documents, screenshots. The advisory notes that this access can serve as a foothold into the networks of the victim’s employer or clients, opening the door to intellectual property theft and espionage.

What the authorities recommend

The FBI and the Japanese police assess that WaterPlum operators, along with some of the fake North Korean remote IT workers, fall under the 313th General Bureau, part of the Munitions Industry Department responsible for weapons research and production. The two activities overlap: according to the advisory, some WaterPlum members also work as remote web developers for clients, and both groups have used the same IP addresses. Identity documents stolen during intrusions are then reused to land jobs under the victims’ names. Japan’s National Police Agency says it has also identified and dismantled the country’s first “laptop farm” linked to these workers, where several hundred million yen in transfers abroad were recorded.

For companies, the advisory calls for verifying candidates’ identity, location and qualifications, and for limiting their access to the systems they actually need. For developers, the instruction is blunter: do not run unknown code outside a sandbox, and inspect the files and code you are sent for commands that will pull down further payloads.

A technical test sent by a recruiter is still code of unknown origin. In this campaign, that test is the payload.