PurpleDelta

WaterPlum ("Contagious Interview"): a seven-agency joint advisory quantifies the DPRK fake-job campaign for the first time, 30,000+ devices, 100+ countries, $10.7M in crypto, and Japan's first dismantled "laptop farm"

Seven government agencies (Japan's National Police Agency and National Cybersecurity Office, the US FBI and DoD Cyber Crime Center, Australia's Signals Directorate/ACSC, and Germany's BND and BfV) jointly published a Cybersecurity Advisory on 2026-09-18 on the North Korean "WaterPlum" cyber-actor group, publicly known as Contagious Interview and already tracked here under that name (FBI/IC3, 2026-09-18). The advisory is the first to attach concrete scale to the campaign: at least 30,000 infected devices across more than 100 countries, funds or credentials exfiltrated from over 7,000 cryptocurrency wallets, and roughly 1.7 billion Japanese yen (about USD 10.7 million) moved to DPRK (FBI/IC3, 2026-09-18). Germany's BfV confirms the campaign has targeted software developers "also in Germany" (translated from German) (Bundesamt für Verfassungsschutz, 2026-09-18).

WaterPlum poses as recruiters, frequently impersonating AI, cryptocurrency or NFT companies, and also using legitimate freelance and recruiting platforms, to lure software developers and IT professionals into a technical interview or take-home coding assignment; victims are told to download and run files hosted on collaboration platforms and code repositories to "complete a coding assignment or troubleshoot an error." Those files carry one of five malware families the advisory names for the first time together: BeaverTail (a JavaScript loader hidden in NPM packages hosted on GitHub or Bitbucket), InvisibleFerret (a Python backdoor), OtterCookie (a JavaScript RAT and infostealer, already tracked here from Elastic's 2026-07-18 SVG-steganography disclosure), OtterCandy (combining OtterCookie and RATatouille features), and StoatWaffle, a modular Node.js loader, credential harvester and RAT that hides inside blockchain-themed decoy VS Code project repositories and auto-executes through a malicious VS Code configuration file the moment the victim opens and trusts the folder (FBI/IC3, 2026-09-18). Once backdoored, operators use the RATs for persistence and lateral pivoting while infostealers harvest browser-stored credentials, clipboard contents, keystrokes, screenshots and cryptocurrency-wallet data to a command-and-control address; the same access lets operators pursue further espionage or intellectual-property theft inside the victim's employer.

The advisory ties the malware-delivery operation to North Korea's separate, long-running remote-IT-worker placement scheme (tracked here as PurpleDelta / Jasper Sleet / UNC5267 / Wagemole / Famous Chollima): "the NPA and the FBI assess both WaterPlum cyber actors and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department subordinate to the Central Committee of the Workers Party of Korea" (FBI/IC3, 2026-09-18); the two operations share a parent organization even though they run distinct tradecraft. Separately, Japanese authorities disclosed "for the first time in Japan" a dismantled "laptop farm" (a facility where an enabler physically hosted employer-issued laptops and remotely operated them on North Korean workers' behalf) moving "several hundred million" yen in cryptocurrency abroad (FBI/IC3, 2026-09-18). The advisory records two prior cases of IT-worker escalation beyond simple wage fraud: one worker extorted an employer over its own source code after a payment dispute, and another defaced and disabled a hiring company's website.

Triage: BeaverTail/InvisibleFerret/OtterCookie-family execution shows up as a node or python process spawned from an IDE or terminal session shortly after a new project folder is opened or an npm install completes, followed by outbound connections to non-corporate destinations and API calls against browser credential stores or the clipboard; legitimate build tooling does not read browser credential stores or poll the clipboard. StoatWaffle's variant of the same pattern is a VS Code auto-run entry (a .vscode configuration file) firing on folder-open/trust in a freshly cloned, blockchain-themed repository the organization's own ticketing has no record of. The distinguishing context, in both cases, is timing correlation with an active job-interview or coding-test process rather than the presence of node/npm/VS Code activity alone.

Builds on: A Swiss research lab co-publishes the DPRK actor-tracking update: two nominally-espionage…

Sekoia and Kudelski Security split the 'Lazarus umbrella' into six named DPRK clusters, and document two of them adopting commodity ransomware-as-a-service within two months of each other

Sekoia's TDR team and Kudelski Security, a Switzerland-based research firm, jointly published a reassessment of how North Korea's offensive-cyber apparatus is organized (Kudelski Security, 2026-09-07). The authors now track the historical "Lazarus umbrella" as six distinct sub-clusters (TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet, and Famous Chollima, the last already tracked here as an alias of the North Korean fraudulent-IT-worker cluster) each carrying a different primary mandate spanning strategic espionage, dual espionage-and-revenue operations, and pure financially motivated crime (Kudelski Security, 2026-09-07). The espionage-focused clusters under GRIB (formerly RGB), TEMP.Hermit among them, are the authors' own described inheritors of both the historical Lazarus umbrella and the Kimsuky cluster's lineage, even where their precise bureau affiliation is debated within the CTI community (Kudelski Security, 2026-09-07). The authors date the Lazarus umbrella's internal reorganization into specialized sub-clusters to a 2018–2023 transition phase alongside the global expansion of the cryptocurrency market, out of which APT38 itself emerged as the financially-motivated sub-cluster; APT38 has since, per the authors' own current research, further split into two of these (CryptoCore and Jade Sleet) both exclusively financially motivated and focused on cryptocurrency, Web3 and blockchain targets, though the authors do not date this more recent split.

The most defender-relevant finding is a documented pattern of commodity-ransomware adoption by nominally espionage-focused units: Andariel, a dual-mandate cluster, used its own custom ransomware (Maui, H0lyGh0st) and separately collaborated with the criminal Play ransomware-as-a-service operation in 2024, citing prior reporting from Unit 42; Moonstone Sleet deployed its own custom malware (FakePenny) the same year and then adopted the Qilin ransomware-as-a-service in 2025, within two months of Andariel's own RaaS adoption (Kudelski Security, 2026-09-07). The authors note it is "interesting" that the two clusters integrated RaaS into their campaigns within two months of each other, a single observed timing overlap, not a claimed broader trend, though it is consistent with the general possibility that DPRK clusters rent commodity ransomware infrastructure alongside, or instead of, running only bespoke tooling.

The report also states that "Reaper" (already tracked here as an alias of ScarCruft/APT37) is the cluster aligned with North Korea's newly renamed National Intelligence Agency (formerly the Ministry of State Security, renamed June 2026), tasked with surveillance of defectors and South Korean NGOs and activists. Kudelski Security's own separate prior research, cited in this report, found that DPRK fake-IT-worker infrastructure and offensive-APT infrastructure share the same VPN exit nodes, a concrete pivot point for correlating IT-worker-fraud indicators against APT intrusion infrastructure (Kudelski Security, 2026-09-07). Separately, the report documents a Cambodia-based money-laundering hub, the Huione Group (flagged by the US Treasury's FinCEN as a primary money-laundering concern) whose executives the authors say have shown indications of direct ties to North Korean actors, with an estimated USD 37.6 million in DPRK-linked cryptocurrency laundered through it between 2021 and 2025 via stablecoins and technical tooling that let North Korea convert illicit proceeds into ostensibly legitimate assets (Kudelski Security, 2026-09-07).

Builds on: A Swiss research lab traces a stealer-log leak into DPRK gambling infrastructure and the… · The command-and-control channel is a legitimate cloud storage API, not a registered domain · Rapid7 finds a DPRK-nexus implant that falsifies HAProxy's own traffic counters so its…

PurpleDelta: Insikt Group gets inside a North Korean IT-worker operation and finds the detectable half is on the endpoint, a second remote-management tool on the company laptop, and a device whose location never matches the login

Insikt Group published its PurpleDelta analysis on 2026-08-18, covering what it describes as a state-directed network of covert North Korean technology workers operating across freelancing platforms and corporate hiring pipelines. On naming, Insikt is unhedged: "The group overlaps with threat actor designations used by other vendors, including Jasper Sleet, UNC5267, Wagemole, and Famous Chollima" (Insikt Group, 2026-08-18); these are presented as different vendors' labels for the same phenomenon rather than as a graded attribution claim. The quantified dataset covers one cluster: "Between late 2024 and early 2025, one cluster applied to jobs at over 1,100 companies, primarily in the software and technology, staffing and consulting, and healthcare and biotechnology sectors" (Insikt Group, 2026-08-18), sometimes at a rate of at least 60 positions a day, with at least 22 fabricated personas maintained across clusters and operators "highly likely to be actively employed by at least ten organizations", Insikt's own hedge, kept as one here.

The geography is the reason this is not a North American story. Roughly four in five target companies were North American, "but the operators applied to companies in every region of the world" (Insikt Group, 2026-08-18), and the sector concentration (software and technology, then staffing and consulting, then healthcare and biotechnology) describes the supplier tier that public-sector and critical-infrastructure organisations in this constituency buy remote technical labour through. This store already carries a Flemish Government agency confirming a North Korean compromise that reached it through a contractor's workstation, which is the same structural exposure arriving by a different route: the organisation's own hiring controls are not the only ones that matter.

What makes the report useful rather than merely alarming is that the fraud leaves endpoint artifacts, and Insikt separates its technical recommendations from its hiring-process advice. The operating model is that a facilitator physically holds the employer-issued laptop while the operator works it remotely over commercial remote-desktop software, with a commercial VPN marketed for circumventing China's national firewall used consistently for connectivity, and Insikt places many of the operators' nexus in Shenyang on the basis of professional profiles, social-media presence and artifacts on their systems. That arrangement cannot be run without leaving two things on a managed device: a remote-access agent the employer did not install, and a persistent mismatch between where the hardware is and where the person claims to be. Insikt's own controls address exactly those, "If you run remote monitoring and management (RMM) software in your organization, ensure that no other RMM software is installed, and deny-list other RMM software on your networks" and "Regularly geolocate company laptops to verify that their locations match employee login locations" (Insikt Group, 2026-08-18), alongside regular port-checking to detect remote access via desktop sharing or VPNs, insider-threat monitoring on company devices, and a requirement that company hardware never be shipped to an anonymised post box or to anyone other than the named individual.

The persona-construction tradecraft is worth knowing mainly because it explains why interview-stage scrutiny fails. Profile photographs come from a face-swapping service and are kept locally on the operator's machine in a dedicated directory; identity documents come from a paid document-generation service; identities and accounts are bought, with Insikt directly observing the purchase of US and Ukrainian identities, while its separate observation of the operators across infostealer-log channels is recorded only as suggesting they may also be buying stolen credentials; contribution histories on code-hosting platforms are fabricated; and multi-account browsers with separate browser profiles and calendars keep the personas apart. Insikt also lists Android emulation software among the operators' tooling without stating what it is used for, and no purpose is inferred here. During live interviews the operators record and transcribe the call and feed questions to purpose-configured chatbot assistants, reading the answers back; Insikt notes the answers were sometimes visibly wrong, which indicates limited subject-matter command rather than genuine skill. One operator was observed running two personas in parallel, one already employed and one interviewing elsewhere, and interview and meeting times for different personas were seen to collide.