● Covered by 1 source · 1 reportMedium impact1 negative
Japan Dismantles First North Korean Laptop Farm, Allies Detail WaterPlum Hacking Scheme
Key points
- Japan dismantled its first North Korean laptop farm.
- WaterPlum infected 30,000 devices in over 100 countries.
- Over $10.71 million was stolen from cryptocurrency wallets.
- WaterPlum and North Korean IT workers are linked to the 313 General Bureau.
International Advisory on North Korean Cyber Operations
Law enforcement and intelligence agencies from Japan, the United States, Australia, and Germany issued a joint advisory attributing a long-running hiring scheme to a North Korean group named WaterPlum, also known as Contagious Interview. The advisory details the group's methods and its connections to North Korea's broader IT-worker scheme.
WaterPlum Campaign Overview
WaterPlum impersonates employers, often AI, cryptocurrency, or NFT companies, to target software developers and IT professionals. The group also uses legitimate recruiting services. Between December 2025 and July 2026, WaterPlum infected at least 30,000 devices across more than 100 countries, primarily targeting web designers, engineers, and specialists in cryptocurrency, blockchain, and web3.
The group stole funds or account credentials from over 7,000 cryptocurrency wallets, with an estimated $10.71 million reaching North Korea. The National Police Agency of Japan and the FBI assess that WaterPlum operators and some North Korean IT workers report to the 313 General Bureau of the Munitions Industry Department, under the Workers’ Party of Korea’s Central Committee. WaterPlum actors and North Korean IT workers have been observed using the same IP addresses.
Impact Beyond Financial Theft
The damage extends beyond stolen cryptocurrency. A compromised developer can provide WaterPlum access to their employer’s network. The group has also used stolen data for extortion and to access personal information and trade secrets.
Japan's Action Against Laptop Farms
The scheme utilizes 'laptop farms,' which are locations, often residences, where devices are set up and operated remotely by North Korean IT workers. Accomplices manage servers to mask the workers' true locations while they perform paid IT work. Japan dismantled one such laptop farm this year, marking the country's first confirmed case of this kind. Japanese authorities obtained evidence that this cyber actor group transferred several hundred million Japanese yen in cryptocurrency to foreign locations outside of Japan.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
Japan has dismantled its first North Korean laptop farm, while a joint advisory from the US, Japan, Australia, and Germany detailed the WaterPlum hacking group's methods. This action reveals a coordinated international effort to counter North Korea's illicit IT worker and cybercrime operations, which fund the regime.