Law enforcement agencies including the Japanese police and the FBI have issued a warning regarding a North Korean hacking group known as WaterPlum, which is allegedly linked to the compromise of approximately 30,000 devices and over 7,000 cryptocurrency wallets.

Investigations reveal that the group has transferred about 1.7 billion yen (approximately $10.71 million) in stolen digital assets to North Korea.

WaterPlum has been connected to the 313th Bureau of the North Korean Department of Military Industry.

The group's operations are characterized by "interviews" and "test tasks." The hackers pose as employers and recruiters, including from companies in the AI and cryptocurrency sectors. Victims receive malicious files under the pretense of skill assessments or troubleshooting issues during interviews.

Method of device infection during an interview. Source: National Police Agency of Japan.

Criminals utilize trojans and infostealers to gain control of devices. Subsequently, WaterPlum steals browser data, private keys, seed phrases, and personal identification documents. The warning highlights malware such as BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle.

The report outlines signs of suspicious applicants, including:

  • refusal to meet in person;
  • requests for salary payments in cryptocurrency;
  • video and audio disruptions, unfamiliar voices, and reading answers from another screen during the interview.

Authorities also uncovered a connection between WaterPlum and a scheme involving North Korean IT workers who secure remote jobs through intermediaries and so-called "laptop farms." These farms consist of computers that are nominally owned by contractors but are remotely controlled from other countries.

Operation principle of a "laptop farm." Source: National Police Agency of Japan.

Japanese officials stated they have identified and disrupted the operation of such a farm managed by a local intermediary for the first time. According to the investigation, the group transferred several hundred million yen in cryptocurrency abroad.

In August, analysts from Genians warned about North Korean hackers employing AI for planning and executing attacks.