[REVISION HISTORY]

North Korean cyber recruitment fraud

Updated 1 time since CLSTR started tracking revisions of this situation.

What changed

2026-09-18 06:27 UTC → 2026-09-18 09:33 UTC · added ~~removed~~

North Korean cyber operatives are utilizing fraudulent recruitment tactics to infiltrate foreign companies and bypass international sanctions. Initial reports indicate a sophisticated method where North Korean teams use third-country nationals from nations including Iran, South Africa, Nigeria, Lebanon, and India to act as proxy interviewers. These facilitators participate in video interviews and coding tests to evade detection, such as AI deepfake filters, before handing technical work to North Korean operatives. A US-led assessment estimated these disguised IT employment schemes earned North Korea up to $800 million in 2024, funds believed to finance weapons development. Following these developments, intelligence agencies in Germany, Japan, the United States, and Australia issued a joint warning regarding a specific campaign dubbed ‘Contagious Interview’. This campaign, attributed to the ‘Waterplum’ group, involves state-sponsored actors using social engineering on social media and freelance marketplaces. By posing as representatives from AI or cryptocurrency firms, attackers guide candidates to download malicious files during fraudulent interviews. These files facilitate the theft of sensitive data and cryptocurrency, which is reportedly used to fund North Korea’s sanctioned programs. Recent data indicates the scale of the ‘Contagious Interview’ operation has expanded significantly, with reports suggesting the group has targeted more than 30,000 devices across more than 100 countries. In at least one documented instance, hackers successfully stole 11 million dollars in cryptocurrency. These stolen assets are believed to be used to bypass international sanctions and finance North Korea’s ballistic missile and weapons programs.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.