started · updated
North Korea cyber group targets IT specialists via fake job offers
International security agencies, including those in Germany, Japan, the United States, and Australia, have issued warnings regarding a North Korean cyber campaign targeting IT professionals. The operation, known in the security community as ‘Contagious Interview,’ utilizes social engineering to manipulate job seekers.
Attackers pose as representatives from artificial intelligence or cryptocurrency companies, contacting software developers through social media, job platforms, and freelance marketplaces. During the fraudulent recruitment process, candidates are prompted to download files for tasks that contain malware. Once access is gained, the attackers steal sensitive data and cryptocurrency.
Reports indicate that the group, sometimes referred to as ‘Waterplum,’ has targeted more than 30,000 devices across more than 100 countries. In one instance, hackers stole at least 11 million dollars in cryptocurrency. The stolen funds are believed to be used to bypass international sanctions and finance North Korea’s weapons and ballistic missile programs.
Entities
Federal Intelligence Service · Federal Office for the Protection of the Constitution · Japan National Police Agency · North Korea · Waterplum
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 11 SOURCES] The cyber campaign is referred to as ‘Contagious Interview’ within the IT security community. www.dattelner-morgenpost.de · www.halternerzeitung.de · www.waltroper-zeitung.de · www.dorstenerzeitung.de · www.stimberg-zeitung.de · +6 more
- [● 11 SOURCES] The attack involves candidates downloading a file for a job task that contains malware. www.dattelner-morgenpost.de · www.halternerzeitung.de · www.waltroper-zeitung.de · www.dorstenerzeitung.de · www.stimberg-zeitung.de · +6 more
- [● 11 SOURCES] Attackers use social media, job platforms, and freelance marketplaces to contact software developers. www.dattelner-morgenpost.de · www.halternerzeitung.de · www.waltroper-zeitung.de · www.dorstenerzeitung.de · www.stimberg-zeitung.de · +6 more
- [● 12 SOURCES] A North Korean cyber group is targeting IT specialists to steal cryptocurrency. www.dattelner-morgenpost.de · www.halternerzeitung.de · www.waltroper-zeitung.de · www.dorstenerzeitung.de · www.stimberg-zeitung.de · +7 more
- [● 11 SOURCES] The cybercriminals pose as representatives of AI or cryptocurrency companies during the recruitment process. www.dattelner-morgenpost.de · www.halternerzeitung.de · www.waltroper-zeitung.de · www.dorstenerzeitung.de · www.stimberg-zeitung.de · +6 more
- [● 12 SOURCES] The stolen cryptocurrency is intended to bypass sanctions and fund North Korea's weapons program. www.dattelner-morgenpost.de · www.halternerzeitung.de · www.waltroper-zeitung.de · www.dorstenerzeitung.de · www.stimberg-zeitung.de · +7 more
- [○ 1 SOURCE] North Korean hackers stole at least 11 million dollars in cryptocurrency from IT professionals across more than 100 countries. hnonline.sk
- [○ 1 SOURCE] The cyberattack targeted more than 30,000 devices used by IT engineers. hnonline.sk