To that end, the National Police Agency of Japan (NPA), the National Cybersecurity Office of Japan (NCO), the U.S. Federal Bureau of Investigation (FBI) and the U.S. Department of Defense Cyber Crime Center (DC3), Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), Germany Federal Intelligence Service (BND) and Germany Federal Office for the Protection of the Constitution (BfV) determined the North Korean “WaterPlum” cyber actor group conducts cyberattacks by infiltrating unsuspecting job seekers’ computer networks, harvesting sensitive information, and stealing cryptocurrency.
NPA and the FBI assess WaterPlum cyber actors and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department. That is subordinate to the Central Committee of the Workers Party of Korea.
WaterPlum actors pose as prospective employers to target software developers and IT professionals worldwide. They work under the pretext of attractive job opportunities. They often impersonate legitimate Artificial Intelligence (AI), cryptocurrency, or Non-Fungible Token (NFT) companies and have also used recruiting services.
Infected 30,000 Devices
WaterPlum actors have infected at least 30,000 devices in more than 100 countries. They also exfiltrated funds or account credentials from over 7,000 cryptocurrency wallets.
WaterPlum actors transferred 1.7 billion Japanese yen (JPY) ($10.71 million) of cryptocurrency assets to the Democratic People’s Republic of Korea (DPRK).
Some WaterPlum actors also operate as North Korean IT workers performing web system design and development tasks on corporate web systems for clients.
For the first time in Japan, authorities successfully identified, investigated, and dismantled a “laptop farm” operated by an enabler in Japan. Japanese authorities obtained evidence this cyber actor group transferred several hundred million Japanese yen in cryptocurrency to foreign locations outside of Japan.
The FBI continues to identify and prosecute U.S.-based actors providing illicit facilitation services to North Korean IT workers. These prosecutions have occurred across the U.S., in a wide variety of jurisdictions, for multiple facilitation related crimes.
The WaterPlum tactics, techniques, and procedures (TTPs) disclosed in this announcement were discovered by the National Cyber Department of Japan’s Kanto Regional Police Bureau, relevant prefectural police, the FBI, and via cooperation and information sharing with private sector partners.
IT professionals in Japan and the United States — and businesses that outsource or commission work via crowdsourcing or other means – should refer to the TTPs and mitigation measures below and implement appropriate security controls.
Click here for more on the global security advisory.