bleeping-computer Sep 19, 2026 · Crawled Sep 19, 2026

North Korean WaterPlum hackers infected 30,000 devices worldwide

1 Actors 5 Malware

AI Summary

North Korean threat actor WaterPlum conducted a global campaign from December 2025 to July 2026, compromising over 30,000 devices and stealing more than $10.7 million in cryptocurrency. The group targeted job seekers by impersonating legitimate companies and delivering malware through malicious npm packages and Visual Studio Code projects. WaterPlum deployed multiple malware families including BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle to steal credentials, cryptocurrency keys, and conduct espionage. The actors are linked to North Korea's 313 General Bureau and operate alongside fraudulent IT worker operations using stolen identities and AI face-swapping during fake interviews.

AI-extracted · verify before operational use

Extracted Entities 6 found

Threat Actor WageMole → Malware Beavertail → Malware InvisibleFerret → Malware OtterCookie → Malware OtterCandy → Malware StoatWaffle →

MITRE ATT&CK TTPs 26 techniques

T1005 Data from Local System · Collection T1027 Obfuscated Files or Information · Defense Evasion T1055 Process Injection · Defense Evasion T1056.001 Keylogging · Collection T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1071 Application Layer Protocol · Command And Control T1071.001 Web Protocols · Command And Control T1071.003 Mail Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1105 Ingress Tool Transfer · Command And Control T1113 Screen Capture · Collection T1114 Email Collection · Collection T1123 Audio Capture · Collection T1133 External Remote Services · Persistence T1482 Domain Trust Discovery · Discovery T1490 Inhibit System Recovery · Impact T1555 Credentials from Password Stores · Credential Access T1566 Phishing · Initial Access T1003 OS Credential Dumping · Credential Access T1056.002 GUI Input Capture · Collection T1059.007 JavaScript · Execution T1195.002 Compromise Software Supply Chain · Initial Access T1110 Brute Force · Credential Access