OTTERCOOKIE

WaterPlum ("Contagious Interview"): a seven-agency joint advisory counts 30,000+ devices in 100+ countries and $10.7M in crypto from December 2025 to July 2026, and discloses Japan's first dismantled "laptop farm"

Seven government agencies (Japan's National Police Agency and National Cybersecurity Office, the US FBI and DoD Cyber Crime Center, Australia's Signals Directorate/ACSC, and Germany's BND and BfV) jointly published a Cybersecurity Advisory on 2026-09-18 on the North Korean "WaterPlum" cyber-actor group, publicly known as Contagious Interview (FBI/IC3, 2026-09-18). The advisory puts figures on the campaign from around December 2025 through July 2026: at least 30,000 infected devices across more than 100 countries, funds or credentials exfiltrated from over 7,000 cryptocurrency wallets, and roughly 1.7 billion Japanese yen (about USD 10.7 million) moved to DPRK (FBI/IC3, 2026-09-18). Germany's BfV confirms the campaign has targeted software developers "also in Germany" (translated from German) (Bundesamt für Verfassungsschutz, 2026-09-18).

WaterPlum poses as recruiters, frequently impersonating AI, cryptocurrency or NFT companies and also using legitimate freelance and recruiting platforms, to lure software developers and IT professionals into a technical interview or take-home coding assignment; victims are told to download and run files hosted on collaboration platforms and code repositories to "complete a coding assignment or troubleshoot an error." Those files carry one of five malware families the advisory names: BeaverTail (JavaScript-based malware hidden inside NPM packages and downloadable from GitHub or Bitbucket), InvisibleFerret (a Python backdoor), OtterCookie (a JavaScript RAT and infostealer), OtterCandy (combining OtterCookie and RATatouille features), and StoatWaffle, a modular Node.js loader, credential harvester and RAT that hides inside blockchain-themed decoy VS Code project repositories and auto-executes through a malicious VS Code configuration file the moment the victim opens and trusts the folder (FBI/IC3, 2026-09-18). Once backdoored, operators use the RATs for persistence and lateral pivoting while infostealers harvest browser-stored credentials, clipboard contents, keystrokes, screenshots and cryptocurrency-wallet data to a command-and-control address; the same access lets operators pursue further espionage or intellectual-property theft inside the victim's employer.

The advisory ties the malware-delivery operation to North Korea's remote-IT-worker placement scheme: "the NPA and the FBI assess both WaterPlum cyber actors and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department subordinate to the Central Committee of the Workers Party of Korea" (FBI/IC3, 2026-09-18). It adds that some WaterPlum actors also operate as North Korean IT workers, and that both used the same IP addresses when accessing laptop farms, using crowdsourcing services and applying for positions at a Japanese cryptocurrency exchange (FBI/IC3, 2026-09-18). Separately, Japanese authorities "for the first time in Japan" identified and dismantled a "laptop farm" operated by an enabler in Japan, and obtained evidence that the actor group transferred "several hundred million" yen in cryptocurrency abroad. The advisory defines a laptop farm as a location, often an enabler's residence, where employment-related computers are set up and remotely controlled by North Korean IT workers (FBI/IC3, 2026-09-18). The advisory records two prior cases of IT-worker escalation beyond simple wage fraud: one worker extorted a company over payment and published its proprietary source code online, and another defaced and disabled a hiring company's website (FBI/IC3, 2026-09-18).

Triage: the advisory lists the data the actors' infostealers target (browser authentication data, clipboard contents, keystrokes, screenshots and wallet data) and the StoatWaffle delivery through a malicious VS Code configuration file that runs when the folder is opened and trusted (FBI/IC3, 2026-09-18). It gives no process lineage, so as a hunting hypothesis expect a node or python process spawned from an IDE or terminal shortly after a new project folder is opened or npm install completes, then reading browser credential stores or the clipboard; legitimate build tooling does neither. The distinguishing context is timing correlation with an active job-interview or coding-test process rather than node, npm or VS Code activity alone.

Builds on: A Swiss research lab co-publishes the DPRK actor-tracking update: two nominally-espionage…

Switzerland's federal cyber authority reports the public sector as still the largest share of mandatory critical-infrastructure notifications, and devotes its half-year report to two things a Swiss defender can act on: the anatomy of the Polish energy sabotage, and a crypto-theft playbook that recruits its victims on LinkedIn

Switzerland's Bundesamt für Cybersicherheit (BACS) published Halbjahresbericht 2026/I (its semi-annual report on the cyber threat landscape in Switzerland and internationally) on 2026-08-24 (BACS, 2026-08-24). Two numbers frame it. Voluntary reports fell to 27,128 for January–June 2026 against 35,727 in H1 2025, with fraud (10,759), phishing (8,877) and spam (3,965) the most-registered categories. Separately, 200 mandatory reports were processed under the critical-infrastructure notification duty in force since 1 April 2025 (and their sector split is the finding this constituency should read first: the public sector and IT/telecommunications continue to be the most frequent reporters, at 19.4% and 18.6% respectively) BACS's own word is "weiterhin", continuing, so this is a persistent ranking rather than a new development. Among those mandatory reports, unauthorised system access (hacking) is the most-reported attack type at just under 26%, which BACS says consists largely of email accounts compromised through successful phishing and then reused to run further phishing and fraud against others; credential theft follows at 13.5%, with DDoS and data exfiltration tied at 12.7% each, and ransomware in roughly 8% of cases.

Three categories fell sharply, and exactly one of them is given a cause. Reports of fraudulent threatening calls made in the name of authorities fell 64% year on year to 3,817, and BACS credits the tightening of the telecommunications services ordinance against call spoofing, noting the measures likely took effect before they formally came into force. Advertising for online investment fraud fell 89% to 387 and CEO fraud 57% to 258; the report records those two as declines without attributing either to a cause, so neither should be read as evidence that a control worked. Set against that, BACS records attackers using AI systematically to produce tailored, personalised content credibly, including one CEO-fraud case in the period that used a cloned voice of the target's superior to push staff toward fraudulent transfers, and romance-scam identities built with AI-generated images, imitated voices and increasingly deepfake-supported video calls.

On initial access BACS reports no Switzerland-specific tradecraft, only global patterns, and three of them are worth a hunt. Malware by email remains a principal vector with fake invoices the commonest pretext; ClickFix, where the victim is induced to run the malicious command themselves, remains widespread, as does the fake-software-update variant, illustrated by a campaign that told targets to install a Zoom update to join a meeting. In the reporting period BACS identified at least 191 Swiss WordPress sites that attackers had compromised and seeded with malicious JavaScript, which makes a visitor's browser fetch further malicious code automatically, with blockchains increasingly used to host and distribute that code. And in a multi-stage case BACS describes, an employee's business mailbox was buried under email bombing, after which the attackers contacted the victim over Microsoft Teams posing as IT help-desk staff, talked them into granting remote access, and installed malware disguised as an update, citing Unit 42's write-up of the pattern. That is the same delivery chain this pipeline covers today from Expel's SynkLoader case, which is worth noting because a Swiss authority independently placing the pattern in its own caseload raises it from one vendor's incident to an expected local vector. BACS also records several large software-supply-chain compromises with global reach in the period, in which the compromise of widely used open-source projects spread credential-stealing software broadly and Swiss organisations were among those affected, citing the Trivy tag compromise, ground this store already holds. Elsewhere it notes attackers defeating multi-factor authentication through intercepted session tokens, device-code phishing and reverse proxies, and an international shift away from technical complexity toward the principle "log in, not break in": rather than intruding without authorisation, attackers increasingly try to obtain legitimate credentials and use them.

The Poland case study, where basic controls, not advanced defence, were the missing layer. The report's second chapter is a full anatomy of the coordinated wave of 29 December 2025 against Polish energy assets, an incident this store tracks. The Polish CERT's public attribution is of the attack infrastructure to Static Tundra, a suspected Russian state actor previously linked to energy-sector espionage (infrastructure, not the operation itself) and BACS then extends that with its own hedge, recording the Poland incident as the first publicly documented sabotage operation in which the group was apparently involved. Targets ran from 30 wind and photovoltaic parks through a large combined heat and power plant supplying heat to around 500,000 people, to a manufacturing company. The attackers went for the distributed control systems used to operate infrastructure remotely rather than the turbines and generators themselves, and at the renewables sites concentrated on the grid connection point, effectively the operator's digital control room for steering and remote monitoring.

How they got in is the part that should change a Swiss operator's priorities. Alongside exploitation of known unpatched vulnerabilities, remote-access points were exposed directly to the internet without multi-factor authentication, the same passwords were reused across multiple devices, and in several cases devices still carried the manufacturer's factory default passwords ("auf den Geräten noch die werkseitigen Standardpasswörter des Herstellers eingestellt"; in several cases the devices still had the manufacturer's factory default passwords set). Firewalls, servers and a range of OT devices were affected: controllers, remote terminal units reached over SSH, intelligent electronic devices such as protection and control relays, and Windows-based HMI workstations running a SCADA suite. Some of those systems handed the attackers system-administrator rights and so unrestricted control. Destruction was then achieved several ways: corrupting controller firmware so devices hung in an endless reboot loop, deleting operating-system files so they could not boot, and resetting other components to factory settings while changing their network configuration so they became unreachable, with wiper malware additionally deployed on the Windows control machines.

The heat plant was hit entirely through the office IT network without touching its industrial control systems, via the perimeter firewall using accounts again unprotected by MFA. There the actors took their time: over roughly a month they mapped which systems could reach the plant's industrial controls (enumerating processes, network connections, routing tables and the ARP cache, and probing file systems on machines whose names contained "scada") then quietly stole credentials to impersonate legitimate users, including an attempt to dump the LSASS process, a forged Kerberos ticket built with a public tool, and a dump of the entire Active Directory database via ntds.dit. On 29 December they pushed the DynoWiper malware to workstations using Group Policy Objects, the same mechanism administrators use to deploy software centrally, and an endpoint detection and response product caught and blocked it before it did broad damage. A slightly modified build failed too, as did direct overwriting of server disks and manipulation of the storage system's RAID configuration. At the third victim, a manufacturer that appears to have been chosen opportunistically, the attackers did not have to defeat the perimeter firewall at all: its configuration including passwords had been stolen in an earlier, unrelated incident and was freely available on a criminal forum. Once in, they established durable access by planting automated routines on the firewall that periodically retrieved valid credentials and weakened account security settings (including disabling MFA) piping the output to a Slack channel for convenience, then moved laterally over an SSL VPN tunnel using penetration-testing tooling and deployed a second wiper, LazyWiper, again through Group Policy from a network share. In all three cases stolen credentials drove lateral movement, and (the detail most worth carrying) the same credentials were used to reach the victims' on-premises and cloud services including Exchange, Teams and SharePoint, where the actors searched specifically for files and mail concerning technical operations and ICS, OT and SCADA systems. BACS notes the campaign required substantial manual effort rather than the AI and automation the wider trend points to, and reads the timing as an opportunistic capability demonstration (signalling) rather than a strategically chosen moment, precisely because the exploited weaknesses were so basic. Its conclusion is explicit: basic cybersecurity measures, not advanced defensive technology, would have been the key to preventing these attacks, strong unique passwords, consistent MFA, network segmentation and timely patching.

For Switzerland specifically, BACS argues the exposure is not symmetrical. Large grid connection points here are for the most part better isolated than Poland's, but that assessment excludes the large number of smaller private feed-in installations, which are permanently connected to the internet and to the manufacturer's cloud, and it cites the National Test Institute for Cybersecurity's study of energy-management systems for private photovoltaic installations as establishing the resulting dependencies and broad attack surface. It also draws a supply-chain lesson from a March 2026 case in which Iran-linked attackers claimed to have wiped all reachable devices of a US medical-device manufacturer by factory reset: the victim was not the most strategically relevant target available, but the attack carried a public message, and Swiss business customers of that manufacturer were affected downstream, unable to place their next order through established channels.

The Dream Job playbook, measured in Swiss cases. The third chapter documents crypto theft run through a staged recruitment process against Swiss individuals and companies in the crypto, blockchain and Web3 sectors, which BACS assesses resembles patterns other authorities have attributed to actors operating on behalf of the DPRK, the campaigns tracked publicly as Operation Dream Job and, in its newer variant, Contagious Interview. The actors first identify people in key positions with privileged access to systems and funds (an independent software developer, or the founder of a crypto organisation) then profile the target's preferred technology stack, personal interests, investment intentions, access to company funds and wallet size. The approach comes on LinkedIn from a well-connected, polished headhunter with an offer that is hard to refuse: to earn a generous six-figure salary a developer need only run a test application and fix its bugs, which means fetching code from a repository that silently compromises their system. For less technical targets the lure is tailored differently (a venture capitalist hunting the next unicorn, or a well-paid operations-manager role for a back-office employee) and runs through a video interview on genuine conferencing software where the connection appears to drop, the interviewer persuasively proposes a quick hotfix to repair the tool, and the "fix" pulls trojanised software dependencies or downloads a second-stage payload named OtterCookie or BeaverTail. Those payloads execute only in memory, harvest credentials, tokens and wallet keys to the operators' infrastructure, and often lead to a bespoke DPRK backdoor for persistence; BACS notes no case has been reported of any other known actor using those specific samples. The attackers then attempt lateral movement into the victim's employer network to steal further assets.

In Switzerland such reports have risen steadily over five years to more than 20 confirmed cases, with victims often connected to the crypto industry in roles from engineer to executive, and losses running "von einigen Tausend bis hin zu rund 60 Millionen Schweizer Franken" (from a few thousand up to around 60 million Swiss francs). BACS is contacted weekly by targets who spot the approach in time, and received just as many reports from victims who realised only afterwards. It expects the true figure to be considerably higher, and names the reason as a structural one rather than a technical one: shame, information asymmetry and lack of awareness. The asymmetry it stresses is between employee and employer. Staff have little incentive to tell their employer about a security breach arising from a job search, which buys the attackers time to work laterally, and BACS has seen cases where several employees of the same company were approached, on the reasonable assumption that they would not compare notes with each other.

Triage: for the Dream Job chain the discriminator is sequence and endpoint role, not the sample. A developer workstation fetching and building an unfamiliar external repository is routine; the same host doing so shortly after an inbound recruiter contact, followed by an in-memory payload reaching out to previously unseen infrastructure and then authenticating to internal systems, is the chain. For the conferencing variant, the tell is a user-run "hotfix" during or just after a video call on legitimate software; a genuine conferencing client updates itself through its own updater and does not ask a user to paste or execute a repair command. BACS's own reporting-behaviour finding is the operational corollary: because the initial compromise arrives through a private job search, the employer usually learns late or not at all, so make it explicitly safe and expected for staff to report a suspicious recruitment approach without implying fault; the report's evidence is that several employees at one company were approached and none compared notes.

Contagious Interview (DPRK) hides an OTTERCOOKIE-aligned payload in SVG-comment steganography inside fake coding-interview repos

Elastic Security Labs disclosed a new instance of the long-running DPRK-aligned Contagious Interview campaign (internally tracked REF9403) after the operators targeted Elastic's own community Slack workspace with a fake job posting and a "coding challenge" project (Elastic Security Labs, 2026-07-18). The lure is a fully functional take-home project (a Next.js e-commerce template copied from a real open-source repository) that a candidate is asked to run. The novelty is where the payload hides: it is "split into Base64 fragments inside HTML comments across every SVG flag image inside an assets directory" (Elastic Security Labs, 2026-07-18). The files look like ordinary country-flag images; a JavaScript loader in the repo reassembles the comment fragments from every flag in alphabetical order, decodes them with a custom Base64 routine, and runs the result with eval(); deliberately avoiding atob() and Buffer.from so simple content scanners do not flag the decode. Because the project's package.json wires the loader into the server entry point, the payload runs on every npm run dev / npm start, and the trojanized repositories "have zero detections and are not flagged by any AV vendors" (Elastic Security Labs, 2026-07-18).

The payload is a four-stage chain Elastic assesses as aligned with OTTERCOOKIE (first documented by NTT Security in December 2024, overlapping the BEAVERTAIL lineage). Stage one enumerates browser profiles across Windows, macOS and Linux and steals saved credentials, autofill data and cryptocurrency-wallet-extension stores, masquerading its process as a benign npm-cache process. Stage two recursively discovers and exfiltrates sensitive files, environment files, private keys, keychains, shell histories, documents and source code. Stage three opens a persistent Socket.IO command-and-control channel giving the operator interactive shell execution, with sandbox/VM detection used to tag rather than halt on analysis machines. Stage four (Windows) drops further second-stage binaries disguised as text files and adds a clipboard stealer polling every 500 ms.