A sophisticated North Korean hacking collective known as WaterPlum has carried out a massive global cyber operation targeting more than 100 countries, resulting in the theft of approximately 1.7 billion yen in cryptocurrency. According to a joint warning issued by several international agencies, including the Japanese National Police Agency and the FBI, the group managed to infect over 30,000 devices with malicious software between December of last year and July of this year. By disguising themselves as corporate headhunters seeking IT talent, the hackers tricked targets into downloading malware hidden within fake technical assessments, allowing them to hijack roughly 7,000 cryptocurrency accounts.
This revelation comes as part of a public attribution effort designed to deter state sponsored cybercrime by exposing the actors involved. Investigators discovered that these digital heists were not isolated incidents but were linked to a broader scheme where North Korean IT workers operated under false identities in China and Russia to secure remote programming jobs. This clandestine workforce funneled hundreds of millions of yen back home using fraudulent profiles, creating a steady stream of foreign currency for the regime.
The scale of the operation relied heavily on an unexpected support network located right inside Japan. Local accomplices allegedly provided the essential hardware, servers, and personal identification documents needed to mask the hackers’ tracks and facilitate financial transfers. While Japanese authorities have since dismantled this domestic network, they found that the IP addresses used for the crypto thefts directly overlapped with those used for these illicit employment schemes.
Evidence suggests that both WaterPlum and its associated freelance programmers operate under the direction of the 313 General Bureau of the Munitions Industry Department. This specific wing of the Workers Party of Korea is tasked with managing national IT strategies and overseeing weapons development, indicating that these cyberattacks serve as a critical funding mechanism for North Korea’s military ambitions.
