Japanese Authorities Warn of North Korean Group WaterPlum

Japanese law enforcement, alongside the FBI, has raised alarms about a North Korean hacking collective named WaterPlum, which is suspected of breaching roughly 30,000 devices and compromising over 7,000 cryptocurrency wallets.

Investigations indicate that WaterPlum has funneled around 1.7 billion yen (approximately $10.71 million) in stolen digital assets back to North Korea.

This group is reportedly associated with the 313th Bureau of the North Korean Department of Military Industry.

WaterPlum's tactics involve deceptive "interviews" and "test tasks." Hackers masquerade as recruiters, often from AI and cryptocurrency companies, tricking victims into downloading malicious files under the guise of skill evaluations or technical support during these interviews.

Through the use of trojans and information stealers, the group gains access to victims' devices, allowing them to pilfer browser data, private keys, seed phrases, and personal identification documents. The warning specifically mentions malware variants such as BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle.

Authorities have identified several red flags associated with suspicious applicants, including:

• unwillingness to conduct in-person meetings;
• requests for salaries to be paid in cryptocurrency;
• technical issues during interviews, such as audio and video disruptions, or candidates reading from off-screen notes.

Additionally, investigators have linked WaterPlum to a scheme involving North Korean IT workers who obtain remote jobs through intermediaries and operate from so-called "laptop farms." These farms consist of computers that appear to be owned by contractors but are actually controlled from abroad.

For the first time, Japanese authorities have successfully identified and disrupted a laptop farm managed by a local intermediary. Reports suggest this group has transferred several hundred million yen in cryptocurrency overseas.

In August, Genians analysts had previously warned that North Korean hackers were leveraging AI to strategize and execute cyberattacks.