Reported by 1 outlet

Timeline

1. original reporting

   Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme

   securityweek.com · 21d ago · September 22nd, 2026

   Law enforcement and intelligence agencies from Japan, the United States, Australia and Germany have published a joint advisory attributing a long-running hiring scheme to a North Korean group they call WaterPlum, also known as Contagious Interview . The document lays out the threat group’s methods, ties some of its members to North Korea’s broader IT-worker scheme , and describes Japan’s first-ever takedown of a North Korean laptop farm. WaterPlum campaign overview WaterPlum poses as employers to reach software developers and IT professionals, often impersonating real AI, cryptocurrency or NFT companies. The group has also used legitimate recruiting services to make contact, according to the advisory. Between December 2025 and July 2026, WaterPlum infected at least 30,000 devices across more than 100 countries. The advisory says its primary targets were web designers, engineers and specialists in cryptocurrency, blockchain and web3. Funds or account credentials were taken from more than 7,000 cryptocurrency wallets, and the agencies estimate that roughly $10.71 million ultimately reached North Korea. The National Police Agency of Japan and the FBI assess that WaterPlum operators and some North Korean IT workers answer to the same part of the regime: the 313 General Bureau of the Munitions Industry Department, under the Workers’ Party of Korea’s Central Committee. The advisory also states that WaterPlum actors and North Korean IT work