Fake interview fraud in North Korea has cost $11 million

A North Korean hacker gang posing as recruiters has infected at least 30,000 devices in over 100 countries, stolen funds or credentials from more than 7,000 crypto wallet s and transferred about 1.7 billion yen ($10.71 million) to the DPRK.

Joint Notice by seven agencies from the Quad

On 18 September, seven agencies from four countries issued a joint communiqué detailing the activities of North Korea's hacker organization known as "WaterPlum" (also called "Contagious Interview" by the security industry). The signatories included the Japan Police Department and State Office cybersecurity , the United States Federal Bureau of Investigation (FBI) and the Cybercrime Center at the Ministry of Defense, the social media 2 Signals Division under the cybersecurity center, and the crypto exchange 24 BND (Federal Intelligence Agency) and BfV (Domestic Security Bureau).

According to the announcement, between approximately December 2025 and July 2026, at least 30,000 devices in more than 100 countries were infected by this organization.

Japan The police department and the FBI assessed that WaterPlum, along with some of North Korea's remote IT workers, were affiliated to the 313th Military Industries Department under the Central Committee of the Workers' Party of Korea. Investigations also found that both operations used the same IP address access point for logging in to laptop farms, using crowdsourcing services and submitting job applications, which the agency judged to be an integrated system.

Implanted under the guise of recruiter malware

The group's tactics are clearly targeted: members disguise themselves as AI, cryptocurrency or NFT companies, contact developers through social media , recruitment websites and freelance career platforms, then arrange a technical interview or an programming test. Candidates will be asked to download documents from the developer's platform for use in completing testing tasks, or patch up some technical glitches during video calls.

Investigators also documented unusual behavioral characteristics of the gang members: some used AI to change their faces during an interview, then cut off video using a pretext for networking problems and asked candidates to turn off cameras as well; they practiced Japanese pronunciation with text-to-speech tools; long-term use of only free machine translation and AI services; playing games and watching football videos on North Korean holidays, suspending daily attacks.

Japan First crash in the country of a notebook farm chicken

Japan For the first time, authorities identified and dismantled a brick-and-mortar laptop farm operated by domestic assistants in the country. The so-called brick and mortar farms typically involve assistants storing multiple work computers at home for remote manipulation of North Korean, Chinese or foreign IT workers. Law enforcement officials found evidence on site that hundreds of millions of yen ( cryptocurrency ) flowed overseas.

Previously, in May 2025, Japan rejected a job applicant whose resume claimed an unreasonably wide range of skills and English level that did not match past experience. Other suspicious signals summarized by the agency included: refusal to do offline interviews, demands for payment with cryptocurrency , frequent looking at second screens on calls, etc.

The larger picture of North Korea-related attacks

The theft was part of a larger attack. According to statistics from security agency CertiK, in 2025, about 60% (about $2.06 billion) of cryptocurrency stolen worldwide were related to North Korea-linked organizations.

This is a risky suggestion, but it's worth considering. . . . This article is for informational purposes only and does not constitute any investment advice. cryptocurrency The market fluctuations are large, please carefully evaluate your risk tolerance, and do the asset security protection.