Reported by 9 outlets

Timeline

1. original reporting

   North Korean-linked actors are targeting tech professionals with fake recruitment interviews to deploy malware and steal cryptocurrency. Per

   cyberworldops.eu · 24d ago · September 19th, 2026

   North Korean-linked actors are targeting tech professionals with fake recruitment interviews to deploy malware and steal cryptocurrency. Per

   via Mastodon https://cyberworldops.eu/en/waterplum-turns-fake-job-interviews-into-a-gateway-for-crypto-theft

2. update from bleepingcomputer.com

   Sandworm hackers target IT pros with trojanized WireGuard VPN client

   bleepingcomputer.com · 63d ago · August 11th, 2026

   Hackers associated with the Russian threat group Sandworm have been targeting system administrators and IT professionals through fake job offers since at least May. A report from the Ukrainian Computer Emergency Response Team (CERT) details a social engineering campaign attributed to UAC-0145, which is believed to be a sub-cluster of Sandworm (APT44). In the campaign, the threat actor targets victims while posing as IT companies and recruiters. The agency says that the attacker studies the targets' resumes uploaded on job sites and then initiates direct contact. Conversations are then moved to Telegram to arrange a video interview over Zoom. During the interview, which is conducted in English, the candidates receive mock technical assignments that require them to connect to a corporate VPN. Conversations with a supposed recruiter Source: CERT-UA In one case that CERT-UA observed, the attacker impersonated the international IT firm Sopra Steria using seemingly legitimate email addresses similar to the company’s office in Bulgaria. “In parallel, additional instructions for the technical interview are sent via email, including configuration files for connecting to a 'corporate' VPN using Wireguard (Linux/Windows) to supposedly perform test tasks,” CERT-UA says . Malicious emails and VPN download link Source: CERT-UA The downloaded file is configured to produce a fake error. The attackers then prompt the victim to download a modified WireGuard-based client called “Sop

3. update from gbhackers.com

   Fake Corporate VPN Test Creates Scheduled Task and Downloads Malware on Windows

   gbhackers.com · 62d ago · August 12th, 2026

   An advanced recruitment-themed intrusion campaign attributed to UAC-0145, a cluster that includes subcluster UAC-0002, also tracked as Sandworm, APT44 and Seashell Blizzard. The activity, observed since at least May 2026, begins on job-search platforms. Operators review a candidate’s résumé, contact the individual while impersonating an IT company such as ATLAS Business Group, and move the […] The post Fake Corporate VPN Test Creates Scheduled Task and Downloads Malware on Windows appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

4. update from cyberpress.org

   Sandworm Fake Job Interviews Push Trojanized WireGuard VPN to Infect IT Professionals

   cyberpress.org · 62d ago · August 12th, 2026

   The campaign has reportedly been active since at least May 2026 and primarily targets system administrators and other technical staff. The operation stands out because it combines a realistic recruitment process with a modified version of a trusted VPN tool . Instead of relying on a simple phishing email, the attackers study candidates’ resumes on job-search platforms and build credibility over several steps. Victims are contacted by people claiming to represent IT companies, including ATLAS Business Group. Initial contact takes place through a job platform’s chat feature before moving to Telegram. There, a fake HR representative discusses the role, work format, and English-language skills. Candidates are then invited to a Zoom interview, which is reportedly attended by a real person speaking English. In one observed case, the sender impersonated Sopra Steria Bulgaria using the spoofed domain soprasteria-bg[.]com , which resembles legitimate Sopra Steria domains but is not associated with the company.

5. update from cyberpress.org

   North Korean IT Workers Recruit Foreign Proxies to Fake Job Interviews and Bypass Hiring Checks

   cyberpress.org · 26d ago · September 17th, 2026

   Cybersecurity researchers at Silent Push have uncovered a suspected North Korean IT worker operation that recruits foreign nationals to act as job-interview proxies. The scheme uses people in the United States, Europe, and Latin America to appear on camera, pass identity checks, receive payments, and hide the real worker’s location. The activity was discovered through a suspicious job advertisement posted in the “Mouse Review” Discord server. The account, identified as “tecguru113,” promoted an offer seeking individuals who could become the public face of an IT job candidate. The operator, known as “Tec Guru,” allegedly offered a revenue-sharing arrangement. The foreign proxy would receive 35% of the income, while 65% would go to the hidden worker. The proxy was expected to join video interviews, communicate with clients, and present technical skills that may not actually belong to them. The assessment was based on technical reference indicators, operational behavior, language patterns, and infrastructure-related evidence. During the conversation, the operator recommended Astrill VPN, a service previously linked by researchers to North Korean threat activity. North Korean Workers Recruit Proxies The operation’s main objective is identity and prox

6. update from cyberscoop.com

   International security agencies warn about North Korean hackers exploiting job seekers to steal crypto, data

   cyberscoop.com · 25d ago · September 18th, 2026

   North Korean hackers are infiltrating tens of thousands of job seekers’ computer networks by posing as prospective employers, such as artificial intelligence firms, to steal sensitive information and millions of dollars worth of cryptocurrency, U.S. and allied governments warned Friday. The security agencies behind the alert, attributed the group, known as WaterPlum or Contagious Interview, as operating under the 313 General Bureau of the Munitions Industry Department subordinate to the Central Committee of the Workers Party of Korea. The efforts dovetail with those of North Korean IT workers . “WaterPlum actors pose as prospective employers to target software developers and IT professionals worldwide under the pretext of attractive job opportunities,” the agencies wrote . “They often impersonate legitimate Artificial Intelligence (AI), cryptocurrency, or Non-Fungible Token (NFT) companies and have also used recruiting services.” Additionally, “Some WaterPlum actors also operate as North Korean IT workers performing web system design and development tasks on corporate web systems for clients,” read the alert from agencies in Japan, Australia and Germany, alongside the FBI and the Department of Defense’s Cyber Crime Center. They’ve used the stolen information to fuel other operations, and the overlap between WaterPlum and North Korean IT workers is substantial, the agencies said. “WaterPlum actors and North Korean IT Workers used the same IP addresses when accessing laptop far

7. update from cyberpress.org

   North Korean WaterPlum Hackers Infect 30,000 Devices via Fake Job Interviews to Steal Crypto

   cyberpress.org · 24d ago · September 19th, 2026

   This campaign primarily targets developers, web freelancers, and cryptocurrency professionals, resulting in the theft of funds or account credentials from more than 7,000 cryptocurrency wallets. A joint advisory from Japanese, U.S., Australian, and German authorities indicates that this activity occurred from approximately December 2025 to July 2026. Investigators estimate that the operation generated at least JPY 1.7 billion, roughly equivalent to $10.71 million, in stolen cryptocurrency for the Democratic People’s Republic of Korea (DPRK). North Korean WaterPlum Hackers WaterPlum utilizes job-search and freelance platforms as an initial access vector. Victims are invited to a virtual technical interview or are asked to complete a coding task. During this process, the attackers instruct candidates to download and execute files supposedly needed to test code, fix a development environment, or resolve video conferencing issues. In some instances, the operators reportedly use AI face-swapping software during interviews, blaming network problems and asking the target to turn of

8. mentioned by gbhackers.com

   North Korean WaterPlum Hackers Target IT Professionals With Fake Job Interviews to Steal Crypto

   gbhackers.com · 24d ago · September 19th, 2026

9. mentioned by gbhackers.com

   WaterPlum, North Korean group, targets IT professionals via fake job interviews to exfiltrate cryptocurrency

   gbhackers.com · 24d ago · September 19th, 2026

10. update from bleepingcomputer.com

    North Korean WaterPlum hackers infected 30,000 devices worldwide

    bleepingcomputer.com · 24d ago · September 19th, 2026

    WaterPlum is linked to a multi-year campaign known as "Contagious Interview," which has previously targeted job seekers with malicious npm packages hat infect their devices with malware. Source: FBI WaterPlum is part of a broader ecosystem of North Korean threat actors that conduct financially motivated attacks to generate revenue for the regime and help fund its weapons programs.

11. mentioned by www.bleepingcomputer.com

    North Korean WaterPlum hackers infected 30,000 devices worldwide https:// bleepingcomputer.com/news/security/ north-korean-waterplum-hackers

    www.bleepingcomputer.com · 24d ago · September 19th, 2026

12. mentioned by www.bleepingcomputer.com

    🤖 North Korean APT group "WaterPlum" compromised at least 30,000 devices worldwide (Dec 2025–Jul 2026) and moved over $10.7M in stolen crypt

    www.bleepingcomputer.com · 24d ago · September 19th, 2026

13. mentioned by www.bleepingcomputer.com

    🤖 North Korean group WaterPlum infected at least 30,000 devices worldwide between Dec 2025 and Jul 2026, per a joint law enforcement advisor

    www.bleepingcomputer.com · 24d ago · September 20th, 2026

14. mentioned by www.bleepingcomputer.com

    North Korean # WaterPlum hackers infected 30,000 devices worldwide https://www. bleepingcomputer.com/news/secu rity/north-korean-waterplum-h

    www.bleepingcomputer.com · 23d ago · September 20th, 2026

15. update from pulseofnations.lol

    North Korean Fake Recruiters Hit 30,000 Devices A joint advisory from four countries says North Korean fake recruiters infected 30,000 devic

    pulseofnations.lol · 22d ago · September 21st, 2026

    North Korean Fake Recruiters Hit 30,000 Devices A joint advisory from four countries says North Korean fake recruiters infected 30,000 devic

    via Mastodon https://pulseofnations.lol/north-korean-fake/

16. update from newisty.com

    North Korean Fake Recruiters Infect 30,000 Devices, Steal $10.7M in Crypto North Korean hacking group WaterPlum posed as recruiters for cryp

    newisty.com · 22d ago · September 21st, 2026

    North Korean Fake Recruiters Infect 30,000 Devices, Steal $10.7M in Crypto North Korean hacking group WaterPlum posed as recruiters for cryp

    via Mastodon https://newisty.com/blog/north-korean-fake-recruiters-infect-30000-devices-steal-107m-in-crypto?utm_source=social&utm_campaign=crypto_news

17. mentioned by securityonline.info

    Discover how the North Korean WaterPlum cyber actor group uses fake job interviews to steal crypto and infiltrate networks globally. # Water

    securityonline.info · 20d ago · September 23rd, 2026