WaterPlum and North Korea’s Fake IT Workers: How the Two Operations Connect

WaterPlum—also known as Contagious Interview—and North Korea’s fraudulent remote IT-worker activity are linked by more than their use of employment-themed deception. Japanese and U.S. authorities assess that WaterPlum actors and some North Korean IT workers operate under the 313 General Bureau, which sits within the Munitions Industry Department subordinate to the Central Committee of the Workers’ Party of Korea.5

The two activities serve different but complementary purposes. WaterPlum uses fake recruiting to compromise people seeking work, steal sensitive information, and take cryptocurrency. The IT-worker scheme uses false identities and location concealment to obtain legitimate remote jobs, producing revenue and potentially placing an insider within a target organization.517

The September 18 advisory: the seven issuing agencies

The September 18 joint cybersecurity advisory was issued by seven agencies across Japan, the United States, Australia, and Germany:1

1. Japan’s National Police Agency (NPA)
2. Japan’s National Cybersecurity Office (NCO)
3. The U.S. Federal Bureau of Investigation (FBI)
4. The U.S. Department of Defense Cyber Crime Center (DC3)
5. The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)
6. Germany’s Federal Intelligence Service (BND)
7. Germany’s Federal Office for the Protection of the Constitution (BfV)

Their assessment names the cyber actor group WaterPlum and notes its association with the campaign commonly called Contagious Interview.1

How the fake-recruiter operation worked

WaterPlum impersonated recruiters or prospective employers and targeted IT professionals, including web designers, engineers, and people working in cryptocurrency, blockchain, and Web3 fields.14

The lures were designed to look like normal steps in a technical hiring process. A target might receive a purported coding task or be asked during a video interview to install a supposed conferencing fix. Instead, these files or instructions delivered malware to the job seeker’s device.15

That approach turns a routine recruitment interaction into an initial-access channel. Rather than attempting to breach a company directly, the operators exploit the trust and urgency surrounding a promising job opportunity.

Scale and impact

The advisory assesses that, from December 2025 through July 2026, WaterPlum infected at least 30,000 devices in more than 100 countries. Funds or account credentials associated with more than 7,000 cryptocurrency wallets were compromised, and the operation received approximately $10.71 million in cryptocurrency.14

These figures describe a campaign that combined broad targeting of technical professionals with a focused financial objective. The theft of credentials is particularly consequential because compromised accounts can enable further fraud even when an immediate transfer is not possible.

Why fraudulent IT workers are a separate—and related—risk

The fraudulent IT-worker scheme relies on operatives concealing their real identity and location to win remote contracts. Government guidance warns that North Korean IT workers have used third-party proxies and facilitators, while companies are urged to strengthen identity verification and detect suspicious account activity.17

The relationship to WaterPlum is organizational and strategic, according to the NPA and FBI assessment—not necessarily proof that every malware victim becomes part of the worker scheme or that every fraudulent worker participates in WaterPlum operations.5 The practical connection is that both exploit the remote-work ecosystem:

• WaterPlum targets candidates from outside an organization through impersonated recruiters and malicious interview materials.
• Fraudulent IT workers seek to enter organizations as apparently legitimate contractors or employees using deceptive identity and location information.

One produces direct compromise and cryptocurrency theft; the other can create a longer-term revenue stream and insider-access risk.

What the New Zealand case illustrates

Reporting on New Zealand’s National Cyber Security Centre described a large New Zealand business that hired a remote IT contractor using a false identity. When the company became suspicious, the contractor threatened to release sensitive information.18

The case is a reminder that identity fraud is not only a payroll or compliance issue. A fraudulently hired worker may gain access to corporate systems, data, credentials, or company-issued equipment before the deception is discovered.

Employer safeguards that matter most

Recruiting, HR, IT, security, and procurement teams should coordinate controls for remote technical roles. U.S. government guidance specifically calls for stronger identity verification, including strict review of identification documents and in-person interviews where appropriate, alongside systems that flag anomalous information in accounts.17

Practical measures include:

• Verify independently. Confirm identity documents, work history, references, payment details, and claimed location through sources not supplied solely by the applicant.
• Make live verification meaningful. Use live interviews and investigate inconsistencies in identity, location, or technical presence rather than treating a video call alone as conclusive proof.
• Control device delivery and access. Avoid shipping corporate equipment before identity and work arrangements are validated; apply managed-device controls and least-privilege access once a worker is onboarded.
• Watch for anomalous access. Review unexpected proxy use, inconsistent login geography, unusual remote-control behavior, and abnormal data movement.
• Prepare for escalation. Have a defined path for security investigation, access revocation, legal review, and extortion response if an identity or insider-access concern emerges.

The core takeaway

WaterPlum demonstrates that a job interview can be used as a malware-delivery mechanism. The related fraudulent IT-worker threat demonstrates that hiring can also be an intrusion path. The shared 313 General Bureau attribution makes the central defensive point clear: organizations need to secure both sides of the employment process—protecting job seekers from fake recruiters and protecting employers from identity-based infiltration.5