Reported by 6 outlets
North Korea infects thousands of devices worldwide through fake job offers
Why this score
- Breadth
- 2.00 / 2.0 · 6 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
This queue slot holds two unrelated campaigns that landed under one "thousands of devices" headline, and telling them apart is the first job. The original event, The Independent's September 22 piece, covers the North Korean fake-recruiter operation tracked as Contagious Interview and WaterPlum, which a joint advisory from Japan, the United States, Australia, and Germany published September 18 at ic3.gov/CSA/2026/260918.pdf puts at more than 30,000 infected devices in over 100 countries, over 7,000 cryptocurrency wallets drained, and at least $10.71 million taken from web designers, engineers, and crypto and Web3 specialists approached with job offers on LinkedIn and similar platforms. The update events describe a second, separate intrusion set: GreyNoise's Global Observation Grid watched a Chinese-speaking actor, scanning and attacking from a single IP address since early June 2026, exploit the wp2shell WordPress chain (CVE-2026-63030 and CVE-2026-60137) alongside ZyXEL GS1900 switches and known flaws in PAN-OS GlobalProtect, FlowiseAI, Nuclio, Proxmox, and Ubiquiti devices, stealing data from 996 devices and more than 18,500 backend database records across at least 49 organizations in 29 countries. GreyNoise attributes the activity to an actor related to Red Heron, the group behind a critical Gitea RCE (CVE-2026-60004), and one intrusion at an unnamed Western government organization involved a custom wp2shell exploit plus Windows reconnaissance checking Microsoft Defender and AMSI state.
The timing is the least current part of both stories, and that is the argument. The wp2shell chain was disclosed July 17 by Searchlight Cyber's Adam Kues (GHSA-ff9f-jf42-662q and GHSA-fpp7-x2x2-2mjf), patched the same day in WordPress 7.0.2 and 6.9.5, added to CISA's KEV catalog July 21, and scripted in public proof-of-concept exploits within days; Searchlight separately reported exploit brokers paying $500,000 for a WordPress RCE of this class, against an install base it estimates at over 500 million sites. September coverage of "Chinese hackers exploiting WordPress" therefore describes a two-month-old, KEV-listed, publicly scripted pre-auth RCE, and the operative question is not who is attacking but which internet-facing installs still run 6.9.0 through 6.9.4 or 7.0.0 through 7.0.1, with 6.8.x exposed to the CVE-2026-60137 SQL injection alone. The DPRK half is the same pattern in slower motion: the September 22 Independent story added nothing to the September 18 advisory it follows. A defender skimming the event list would read two fresh outbreaks; in fact both are late echoes, and neither shares infrastructure, victims, or remediation with the other.
Remediation splits along the same line. For WordPress, the floor is 7.0.2, 6.9.5, or 6.8.6 by branch (7.1 beta2 also carries the fix); WordPress.org is forcing auto-updates, so stragglers are hosts with updates disabled and need manual verification. Until patched, block /wp-json/batch/v1 and ?rest_route=/batch/v1 at the WAF or disable anonymous REST API access, noting Cloudflare's finding that the vulnerable path is reachable when no persistent object cache is in use. Hunt web server access logs for requests to the batch endpoint, for newly created administrator accounts, and for unfamiliar plugin directories or PHP files; Rapid7 has shipped unauthenticated detection checks since its July 20 content release, and Searchlight's wp2shell.com checker confirms exposure directly. Update ZyXEL GS1900 firmware and hunt for the GreyNoise actor's pattern, repeated exploit attempts against WordPress, GlobalProtect, Proxmox, and Ubiquity endpoints from one source IP, pulling the 18,500-record database exfiltration angle into any breach review for the 49 affected organizations. For the recruiter campaign, treat job-assessment coding tests as hostile payloads on developer endpoints and hunt for the BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle families the advisory and NTT Security Japan's September 18 research index enumerate.
Two developments would change this assessment. Mass wp2shell scanning beyond the 49 confirmed organizations, visible in GreyNoise sensor volume or hosting-provider cleanup reports, would convert targeted exploitation into background noise, at which point edge blocking of the batch endpoint is the only control that scales ahead of patch verification. And a follow-up to the four-country advisory, or NTT's continued tracking of OtterCookie capability additions, that ties WaterPlum more tightly to the IT-worker proxy scheme now recruiting through Discord's "Mouse Review" server would confirm the campaign's shift from draining individual wallets toward insider placement and corporate infiltration through employed developers.
Timeline
-
original reporting
North Korea infects thousands of devices worldwide through fake job offers
the-independent.com · 21d ago · September 22nd, 2026
submitted by /u/theindependentonline [link] [comments]
via reddit r/cybersecurity: North Korea infects thousands of devices worldwide through fake job offers
-
update from rapid7.com
CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core
rapid7.com · 89d ago · July 17th, 2026
Rapid7's Emergent Threat Response post, initially published July 17, 2026 and updated July 22, explains the chain: a logic flaw in the REST API batch processor at /wp-json/batch/v1 desynchronizes validation and execution arrays, which lets CVE-2026-60137's SQL injection in the author__not_in parameter of the posts endpoint bypass parameter validation, ultimately creating an administrator account and uploading a malicious plugin. It carries a CVSS 7.5 score per the advisory and reports that both CVEs were added to CISA's KEV catalog on July 21 with public proof-of-concept exploits circulating. Cloudflare reported the vulnerable code path is reachable when a persistent object cache is not in use, and Rapid7 recommends reviewing HTTP access logs for anomalous batch endpoint requests and unfamiliar plugins or PHP files.
-
update from jp.security.ntt
WaterPlum threat research overview (NTT Security Japan technical blog)
jp.security.ntt · 26d ago · September 18th, 2026
Four days before the Independent piece, NTT Security Japan published an index of its WaterPlum research, linking its four published technical posts on the malware used by the Contagious Interview actors: OtterCookie and its function additions, OtterCandy, and StoatWaffle. The post is dated 2026.9.18 on the page.
-
update from ic3.gov
Joint cybersecurity advisory on the North Korean fake-recruiter campaign (260918.pdf)
ic3.gov · 26d ago · September 18th, 2026
The FBI's IC3 hosts the joint cybersecurity advisory on WaterPlum/Contagious Interview, dated September 18, 2026 per its canonical 260918 CSA URL, issued by agencies from Japan, the United States, Australia, and Germany. As reported by The Hacker News, the advisory documents at least 30,000 compromised devices in over 100 countries, more than 7,000 cryptocurrency wallets drained, and at least $10.71 million stolen, and states some WaterPlum actors also operate as North Korean IT workers, with a laptop farm in Japan identified and dismantled.
-
update from thehackernews.com
Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto
thehackernews.com · 23d ago · September 21st, 2026
The piece enumerates the campaign's malware families, including BeaverTail, InvisibleFerret, FlexibleFerret, GolangGhost, PylangGhost, OtterCookie, RATatouille, OtterCandy, and StoatWaffle, and notes a laptop farm operated by a facilitator in Japan was dismantled. It also covers Silent Push's finding of proxy hiring through a Discord server named Mouse Review offering facilitators $3,000 to $5,000 per landed job.
-
update from bleepingcomputer.com
Chinese hackers exploit WordPress, Zyxel flaws to steal govt data
bleepingcomputer.com · 21d ago · September 22nd, 2026
A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases. The adversary targeted multiple technologies, including PAN-OS Global Protect, FlowiseAI, Nuclio, Proxmox, Ubiquity, with exploits for known security issues. Scans and attacks attributed to the adversary originate from the same IP address and have been recorded since early June 2026, and have been attributed to a threat actor related to the Red Heron group, linked to exploiting a critical flaw in the Gitea self-hosted Git service. The activity was detected by threat intelligence company GreyNoise through its Global Observation Grid (GOG) network of sensors. According to the researchers, the threat actor leveraged the wp2shell vulnerabilities (CVE-2026-63030 and CVE-2026-60137) in the WordPress Core component to breach at least 49 organizations in 29 countries. Public exploits for wp2shell became available in mid-July, and active exploitation was observed a few days later . The campaign GreyNoise observed started around the same time, targeting high-value entities. While many targets were in the small business and government sectors, one intrusion at an unnamed Western government organization stands out. The attacker used a custom wp2shell exploit and performed extensive Windows and security reconnaissance, checking Microsoft Defender, AMSI, available services,
-
update from www.bleepingcomputer.com
Chinese hackers exploit # WordPress , # Zyxel flaws to steal govt data https://www. bleepingcomputer.com/news/secu rity/chinese-hackers-expl
www.bleepingcomputer.com · 20d ago · September 23rd, 2026
Chinese hackers exploit # WordPress , # Zyxel flaws to steal govt data https://www. bleepingcomputer.com/news/secu rity/chinese-hackers-expl
via Mastodon https://www.bleepingcomputer.com/news/security/chinese-hackers-exploit-multiple-technologies-to-steal-govt-data/