Japan Seizes First North Korean Laptop Farm; WaterPlum Infections Hit 30,000 Devices

Law enforcement agencies documented WaterPlum operators impersonating crypto and AI recruiters to compromise 30,000 hosts across 100 countries between December 2025 and July 2026. Over 7,000 wallets were drained, with roughly $10.71 million traced to regime accounts. Japan’s National Police Agency confirmed the farm seizure after hundreds of millions of yen moved through Japanese exchanges to foreign endpoints. IP address reuse between WaterPlum C2 nodes and known 313 Bureau IT-worker logins supplied the key link.

Contract records and prior indictments show the 313 Bureau has run parallel IT-worker and remote-access schemes since at least 2021. The advisory’s claim of unified command is supported by overlapping VPN endpoints and identical resume templates, yet no independent packet capture or malware sample has been released to confirm code-level continuity. This gap leaves open the possibility that parallel cells share only logistics rather than a single tasking authority.

The operational pattern is clear: compromised developer machines provide both direct wallet theft and secondary access into employer networks for extortion or data sales. Allies have prosecuted US-based facilitators; similar facilitators remain active in Europe and Southeast Asia. Expect additional farm seizures once exchanges begin sharing the flagged wallet clusters identified in the joint advisory.

Next indicators will appear in procurement filings for new sanctions-evasion tools and in court dockets listing additional US or EU-based accomplices. Sustained pressure on exchanges and video-interview platforms will force the Bureau to shift to deeper proxies or fully synthetic applicants.