Pyongyang's HR Dept Is Hiring: $11M and 7,000 Wallets Later, Recruiters Still Ghosting Victims

A North Korean threat cluster tracked as WaterPlum by Japanese authorities and as Contagious Interview by private security firms has siphoned roughly $10.71 million in cryptocurrency to Pyongyang after compromising more than 7,000 wallets, according to a joint advisory published September 18 by seven agencies across four countries. The same operation is assessed to have infected at least 30,000 devices in more than 100 countries between roughly December 2025 and July 2026, with targets including web designers, engineers and specialists in crypto, blockchain and Web3 work.

The advisory is signed by Japan's National Police Agency, Japan's National Cybersecurity Office, the FBI, the U.S. Department of Defense Cyber Crime Center, the Australian Signals Directorate's Australian Cyber Security Centre, and Germany's BND foreign intelligence service and BfV domestic security agency. The NPA and FBI assess that both WaterPlum and North Korea's remote IT workers report to the 313 General Bureau of the Munitions Industry Department, which sits under the Workers' Party of Korea central committee. Investigators cited overlapping IP addresses tied to laptop farms, crowdsourcing services and job applications as evidence the two operations are one.

The actors impersonate AI, crypto or NFT companies and approach developers through social media, job boards and freelance marketplaces, then schedule a technical interview or coding task. Candidates are instructed to download files from developer platforms either to complete the assignment or to fix an apparent fault in the video call. The advisory names five malware families carried in those packages, including BeaverTail, InvisibleFerret and StoatWaffle, the last of which hides in blockchain-themed repositories.

Investigators logged behavioral markers of the crew itself, noting that members used AI face-swapping software during interviews before cutting video and asking the candidate to do the same, blaming connectivity issues. They practiced Japanese pronunciation with text-to-speech tools, worked consistently on free machine-translation and AI tiers, and on North Korean holidays played games and watched soccer videos instead of running their usual operations. Japanese authorities also identified and dismantled a domestic laptop farm run by a Japanese enabler, the first such case in the country, finding evidence that several hundred million yen in crypto had been moved abroad.