North Korean Cyber Group Steals $11 Million Through Job Scams

Overview of Cyber Heist

Law enforcement from Japan, the U.S., Australia, and Germany revealed a North Korean cyber group, dubbed "WaterPlum," executed a sophisticated scheme that compromised around 30,000 devices globally. This operation successfully infiltrated over 7,000 cryptocurrency wallets, resulting in the transfer of approximately $10.71 million to North Korea.

This cybersecurity breach was highlighted in a joint advisory issued on September 18, 2026, detailing the group's extensive outreach to professionals in cryptocurrency and blockchain sectors, particularly targeting developers and engineers.

Details of the Operation

The advisory, co-signed by multiple agencies, including Japan's National Police Agency and the FBI, outlines the tactics employed by WaterPlum. The group impersonated companies in sectors like AI and NFTs to entice job seekers, leading them to download malicious files under the pretense of technical interviews or coding assessments. These downloads were linked to various types of malware, including BeaverTail and InvisibleFerret.

Notably, Japanese authorities have taken decisive action by dismantling a domestic laptop farm associated with this operation, marking a significant step in countering cybercrime in Japan. This farm was found to be linked to hundreds of millions of yen transferred overseas, with earlier suspicious activities raising alarms about the applicants' credentials and behaviors.

Wider Implications

This incident is part of a larger trend, as data indicates North Korean-linked cyber groups were responsible for 60% of all cryptocurrency thefts in 2025, amounting to approximately $2.06 billion. This followed high-profile hacks such as the Drift Protocol incident, where attackers masqueraded as a trading firm.

Conclusion

The implications of these cyber operations extend beyond mere financial loss, highlighting the need for enhanced cybersecurity measures and diligence in the tech job market.