WaterPlum ("Contagious Interview"): a seven-agency joint advisory counts 30,000+ devices in 100+ countries and $10.7M in crypto from December 2025 to July 2026, and discloses Japan's first dismantled "laptop farm"
Seven agencies report DPRK's fake-interview crew infected 30,000+ devices and took $10.7M in crypto between December 2025 and July 2026
Analysis
Seven government agencies (Japan's National Police Agency and National Cybersecurity Office, the US FBI and DoD Cyber Crime Center, Australia's Signals Directorate/ACSC, and Germany's BND and BfV) jointly published a Cybersecurity Advisory on 2026-09-18 on the North Korean "WaterPlum" cyber-actor group, publicly known as Contagious Interview (FBI/IC3, 2026-09-18). The advisory puts figures on the campaign from around December 2025 through July 2026: at least 30,000 infected devices across more than 100 countries, funds or credentials exfiltrated from over 7,000 cryptocurrency wallets, and roughly 1.7 billion Japanese yen (about USD 10.7 million) moved to DPRK (FBI/IC3, 2026-09-18). Germany's BfV confirms the campaign has targeted software developers "also in Germany" (translated from German) (Bundesamt für Verfassungsschutz, 2026-09-18).
WaterPlum poses as recruiters, frequently impersonating AI, cryptocurrency or NFT companies and also using legitimate freelance and recruiting platforms, to lure software developers and IT professionals into a technical interview or take-home coding assignment; victims are told to download and run files hosted on collaboration platforms and code repositories to "complete a coding assignment or troubleshoot an error." Those files carry one of five malware families the advisory names: BeaverTail (JavaScript-based malware hidden inside NPM packages and downloadable from GitHub or Bitbucket), InvisibleFerret (a Python backdoor), OtterCookie (a JavaScript RAT and infostealer), OtterCandy (combining OtterCookie and RATatouille features), and StoatWaffle, a modular Node.js loader, credential harvester and RAT that hides inside blockchain-themed decoy VS Code project repositories and auto-executes through a malicious VS Code configuration file the moment the victim opens and trusts the folder (FBI/IC3, 2026-09-18). Once backdoored, operators use the RATs for persistence and lateral pivoting while infostealers harvest browser-stored credentials, clipboard contents, keystrokes, screenshots and cryptocurrency-wallet data to a command-and-control address; the same access lets operators pursue further espionage or intellectual-property theft inside the victim's employer.
The advisory ties the malware-delivery operation to North Korea's remote-IT-worker placement scheme: "the NPA and the FBI assess both WaterPlum cyber actors and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department subordinate to the Central Committee of the Workers Party of Korea" (FBI/IC3, 2026-09-18). It adds that some WaterPlum actors also operate as North Korean IT workers, and that both used the same IP addresses when accessing laptop farms, using crowdsourcing services and applying for positions at a Japanese cryptocurrency exchange (FBI/IC3, 2026-09-18). Separately, Japanese authorities "for the first time in Japan" identified and dismantled a "laptop farm" operated by an enabler in Japan, and obtained evidence that the actor group transferred "several hundred million" yen in cryptocurrency abroad. The advisory defines a laptop farm as a location, often an enabler's residence, where employment-related computers are set up and remotely controlled by North Korean IT workers (FBI/IC3, 2026-09-18). The advisory records two prior cases of IT-worker escalation beyond simple wage fraud: one worker extorted a company over payment and published its proprietary source code online, and another defaced and disabled a hiring company's website (FBI/IC3, 2026-09-18).
Triage: the advisory lists the data the actors' infostealers target (browser authentication data, clipboard contents, keystrokes, screenshots and wallet data) and the StoatWaffle delivery through a malicious VS Code configuration file that runs when the folder is opened and trusted (FBI/IC3, 2026-09-18). It gives no process lineage, so as a hunting hypothesis expect a node or python process spawned from an IDE or terminal shortly after a new project folder is opened or npm install completes, then reading browser credential stores or the clipboard; legitimate build tooling does neither. The distinguishing context is timing correlation with an active job-interview or coding-test process rather than node, npm or VS Code activity alone.
Cited evidence
WaterPlum actors have infected at least 30,000 devices in more than 100 countries and exfiltrated funds or account credentials from over 7,000 cryptocurrency wallets. WaterPlum actors have transferred 1.7 billion Japanese yen (JPY) (equivalent to 10.71 million USD) of cryptocurrency assets to the Democratic People's Republic of Korea (DPRK).
WaterPlum actors upload malicious Node Package Manager (NPM) packages embedded with either BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, or StoatWaffle malware and related variants.
The NPA and the FBI assess both WaterPlum cyber actors and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department subordinate to the Central Committee of the Workers Party of Korea.
For the first time in Japan, authorities successfully identified, investigated, and dismantled a "laptop farm" operated by an enabler in Japan.
Updates2
The advisory does not name the IT-worker scheme by any vendor alias, and it does not claim to be the first to quantify the campaign or to name its five malware families together. Its only first is Japan's dismantled laptop farm. It gives its device, wallet and USD 10.7 million figures for the period from around December 2025 through July 2026, not for the campaign as a whole. Its interview flags for suspected North Korean IT workers are refusals or excuses regarding in-person meetings, requests for cryptocurrency payment, glances at another monitor, background voices, and repeated video or audio freezes (FBI/IC3, 2026-09-18).
The advisory describes BeaverTail as JavaScript-based malware hidden inside NPM packages and downloadable from GitHub or Bitbucket, not as a loader (FBI/IC3, 2026-09-18).
The joint advisory lists the data the actors' infostealers target and describes a malicious VS Code configuration file that runs code when the folder is opened and trusted, but it gives no process lineage or network pattern (FBI/IC3, 2026-09-18). The node or python process chain in the triage guidance is a hunting hypothesis, not behavior the agencies report. The takeaway's first control now addresses the people the fake recruiters approach: software developers and other IT professionals looking for work, who are asked during a supposed application process to download a file that contains the malware (heise online, 2026-09-18).
Sources4
Revision history
- Published 2026-09-19T0409Z-intel
- Correction 2026-09-30T0639Z-audit
The priority moves from high to notable: the advisory documents an established campaign and asks no new decision of Swiss public bodies this week. The text had equated the advisory's North Korean IT workers with vendor aliases the advisory never uses, and the PurpleDelta IT-worker actor is no longer linked. It also claimed the advisory was the first to quantify the campaign and to name the five families together, listed interview flags the advisory does not give, and gave the advisory's figures without their December 2025 to July 2026 period. The title, headline, summary and main text now follow the advisory, including its interview flags, its statement that some WaterPlum actors also work as IT workers, its laptop-farm definition and its BeaverTail description, and the takeaway gains its VS Code and command-line controls.
Changed: priority body title summary entities headline
- Correction 2026-10-11T1307Z-audit
The triage guidance presented a node or python process chain after an npm install as observed behavior, but the joint advisory gives no process lineage or network pattern. The guidance now cites the advisory for what it does state (the data the actors' infostealers target and the VS Code configuration-file auto-run) and marks the process chain as a hunting hypothesis. The takeaway's first control now addresses the employees the fake recruiters approach rather than the hiring workflow.
Changed: body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.