A new multinational advisory warns that North Korean WaterPlum actors, commonly referred to as Contagious Interview, are targeting software developers and IT professionals through fake employment opportunities while North Korean IT workers continue efforts to obtain legitimate employment and contractor access inside organizations. The advisory brings together reporting and investigations from authorities in Japan, the United States, Australia, and Germany and highlights the convergence between malicious cyber activity, fraudulent hiring, insider access, cryptocurrency theft, and North Korean revenue generation.
WaterPlum actors pose as prospective employers, including legitimate AI, cryptocurrency, and NFT companies, and use social media, recruiting platforms, freelance marketplaces, technical interviews, and coding assignments to deliver malware. Victims may be instructed to execute malicious files or code during an interview, allowing actors to establish remote access, steal credentials and sensitive information, and potentially pivot into the networks of organizations employing targeted developers. The advisory also details North Korean IT workers’ use of laptop farms, false identities, intermediaries, and remote access infrastructure to obtain legitimate work and organizational access.
The guidance provides practical mitigations spanning both security and hiring processes. Organizations should scrutinize unusual applicant behavior and inconsistencies, validate claimed skills and certifications, restrict access according to least privilege, carefully manage contractors and downstream subcontractors, and promptly revoke accounts and active sessions when malicious activity is suspected. For developers and IT professionals, the advisory recommends avoiding execution of untrusted code, using sandboxed or virtual environments for unknown code, exercising caution with unfamiliar VS Code projects, deploying endpoint detection and response capabilities, and isolating suspected compromised devices.
This directly reinforces several Gate 15 15 from 15 fundamentals, particularly People, Assess, Security Stack, MFA, and Organizational Culture. WaterPlum demonstrates why cyber resilience cannot reside exclusively with the security team: recruiting, HR, hiring managers, developers, procurement, IT, and security may each encounter different indicators of the same campaign. Organizations that connect those functions, validate identities before granting trusted access, minimize privileges, and prepare employees to recognize malicious recruitment and coding activity are better positioned to interrupt the attack chain before an adversary gains an organizational foothold. Gate 15’s 15 from 15: Blocking and Tackling Cybersecurity & Resilience.
Action: Review your hiring and contractor onboarding process with HR, IT, security, and procurement. Where could a fraudulent applicant, contractor, or compromised developer move from “candidate” to “trusted user” without someone recognizing the warning signs—and who owns stopping that transition?
Cyber and all-hazards risk and resilience. At Gate 15 we apply a threat-informed & risk-based approach to analysis, resilience, & operations, helping to secure America’s People, Places, Data, & Dollars. Learn more at www.gate15.global. Join Gate 15’s Resilience and Intelligence Portal (GRIP) and connect to our homeland security community. Join the GRIP!
Additional Info
- ASD: North Korean “WaterPlum,” commonly referred to as “Contagious Interview,” cyber actor group targeting IT professionals; Activities of North Korean IT Workers in Japan, the United States and Europe
- Gate 15: 15 from 15: Blocking and Tackling Cybersecurity & Resilience (link to white paper)
Understand the Threats.
Assess the Risks.
Take Action.
