Japan says it dismantled its first confirmed North Korean laptop farm, while the US, Australia and Germany jointly described a wider WaterPlum campaign targeting developers and IT workers. The advisory links WaterPlum, also known as Contagious Interview, to North Korea’s broader fake IT-worker scheme and says the group infected at least 30,000 devices in more than 100 countries between December 2025 and July 2026, stole from more than 7,000 cryptocurrency wallets, and routed about $10.71 million to North Korea through fake job and employer lures.
Why it matters: This matters to software developers, cryptocurrency firms, and employers hiring remote technical staff because a fake recruiting approach can lead to wallet theft, malware infections, and access into company networks. Organizations should tighten hiring verification, watch for remote-access misuse tied to laptop farms, and warn staff about interview and recruiter lures.
Eduard Kovacs
2026.09.22
100% relevant
This article establishes a distinct tracked story by tying a named North Korean campaign, WaterPlum, to a multinational advisory and Japan’s first confirmed takedown of a laptop farm used in the operation.
← Back to all stories