Law enforcement and intelligence agencies from Japan, the United States, Australia and Germany have published a joint advisory attributing a long-running hiring scheme to a North Korean group they call WaterPlum, also known as Contagious Interview.
The document lays out the threat group’s methods, ties some of its members to North Korea’s broader IT-worker scheme, and describes Japan’s first-ever takedown of a North Korean laptop farm.
WaterPlum campaign overview
WaterPlum poses as employers to reach software developers and IT professionals, often impersonating real AI, cryptocurrency or NFT companies. The group has also used legitimate recruiting services to make contact, according to the advisory.
Between December 2025 and July 2026, WaterPlum infected at least 30,000 devices across more than 100 countries. The advisory says its primary targets were web designers, engineers and specialists in cryptocurrency, blockchain and web3.
Funds or account credentials were taken from more than 7,000 cryptocurrency wallets, and the agencies estimate that roughly $10.71 million ultimately reached North Korea.
The National Police Agency of Japan and the FBI assess that WaterPlum operators and some North Korean IT workers answer to the same part of the regime: the 313 General Bureau of the Munitions Industry Department, under the Workers’ Party of Korea’s Central Committee.
The advisory also states that WaterPlum actors and North Korean IT workers have been seen using the same IP addresses, including when accessing laptop farms and applying for jobs.
The government agencies noted that the damage does not stop at stolen wallets. A compromised developer can give WaterPlum a path into their employer’s network, and the group has also used stolen data for extortion or to access personal information and trade secrets.