North Korean WaterPlum Overlaps IT Worker Farms with Contagious Interview Malware Chain, Hits 30,000 Devices
WaterPlum's Contagious Interview operation merges North Korean state cyber collection with revenue generation through IT worker proxies and crypto theft. Shared infrastructure and malware reuse provide stronger evidence of unified command than official statements alone. The campaign's reach into corporate environments via targeted developers signals expanding espionage risk beyond financial loss.
Next indicators to watch include new Discord-based proxy recruitment and additional facilitator arrests in Japan or the US. Continued use of the same malware families across clusters suggests minimal operational security changes despite public exposure.
CISA: At least two additional Japanese or US laptop farms linked to WaterPlum will be publicly dismantled before March 2026.
Sources (3)
- [1]Joint Cybersecurity Advisory on Contagious Interview(https://www.cisa.gov/news-events/cybersecurity-advisories)
- [2]Unit 42 Contagious Interview Report(https://unit42.paloaltonetworks.com/contagious-interview/)
- [3]DTEX North Korean IT Worker Assessment June 2025(https://www.dtexsystems.com/)