A job interview that ends with a coding test can look routine to a software developer. Security agencies in Japan, the US, Australia and Germany say North Korean operatives have turned that familiar step into a route for installing malware on job seekers’ computers.
In a joint advisory issued on 18 September, the agencies said the group known as WaterPlum, also commonly called Contagious Interview, had infected more than 30,000 devices across 100 countries. The campaign has compromised more than 7,000 cryptocurrency wallets and caused losses of $10.71 million, the advisory said. The stolen cryptocurrency was believed to have been sent to the Democratic People's Republic of Korea, or DPRK, government.
The operation has been underway since at least 2022. It targets software developers and information technology professionals by posing as recruiters for legitimate artificial intelligence, cryptocurrency and non-fungible token companies. The false recruiters advertise jobs through online recruitment sites, social media, gig-work platforms and freelance marketplaces.
Applicants who enter the supposed interview process are directed to download and run files hosted on developer platforms and code repositories, according to the advisory. The files appear to be programming assignments or technical tests. They contain concealed malware that allows the attackers into the applicant’s computer.
The agencies said WaterPlum uses persistent remote access trojans, or RATs, which can leave the operators able to reach an infected system months after an interview. The malware families identified include BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, StoatWaffle, FlexibleFerret, GolangGhost, PylangGhost and RATatouille.
Once installed, the software can collect login credentials, clipboard data, keystrokes and screenshots. It can also seek cryptocurrency private keys and seed phrases, along with files such as identity documents and passport scans. The advisory said stolen identity images can later be used by North Korean information technology workers seeking to impersonate victims and generate foreign currency.
The deception can extend to the interview itself. WaterPlum members use artificial intelligence face-swapping software during online interviews, the agencies said, before citing technical problems and switching off their video. The method allows an operator to present a seemingly credible candidate or recruiter while limiting scrutiny during a live call.
US and Japanese officials believe WaterPlum is connected to the 313 Bureau of North Korea's Department of Military Industry. That bureau is subordinate to the Central Committee of North Korea's ruling Workers' Party, according to the advisory.
The campaign sits alongside another source of revenue attributed to the DPRK government: fake information technology personnel employed by legitimate companies. The government uses those workers to net $500 million annually, the agencies said. Amazon has blocked over 1,800 suspected North Korean applications since April 2024.
The advisory was issued by Japan's National Police Agency, the US Federal Bureau of Investigation, and cyber and intelligence agencies from Australia and Germany. It did not identify individual victims or companies, provide a country-by-country breakdown of infections, or say whether funds had been recovered. It did, however, describe a campaign built around a basic fact of technology hiring: skilled applicants are accustomed to proving their abilities by running code supplied by strangers.
Comments (0)