Japan Dismantles North Korean Laptop Farm in WaterPlum
Japan, the US, Australia, and Germany detail a North Korean hiring scheme that stole over $10 million and infected 30,000 devices.
Law enforcement and intelligence agencies from Japan, the United States, Australia, and Germany have jointly attributed a long-running cyber hiring scheme to a North Korean group they call WaterPlum. The advisory details the group's methods, links it to North Korea's broader IT-worker operations, and reveals Japan's first-ever takedown of a North Korean laptop farm.
WaterPlum poses as employers, often impersonating legitimate AI, cryptocurrency, or NFT companies, to contact software developers and IT professionals. The group has also used real recruiting services to make initial contact. Between December 2025 and July 2026, the campaign infected at least 30,000 devices across more than 100 countries.
Primary targets included web designers, engineers, and specialists in cryptocurrency, blockchain, and web3 technologies. The operation stole funds or credentials from more than 7,000 cryptocurrency wallets. The agencies estimate that roughly $10.71 million ultimately reached North Korea.
The National Police Agency of Japan and the FBI assess that WaterPlum operators and some North Korean IT workers answer to the same part of the regime: the 313 General Bureau of the Munitions Industry Department. The advisory states that these actors have been seen using the same IP addresses, including when accessing laptop farms and applying for jobs.
Compromising a developer gives WaterPlum a potential path into their employer's network. The group has also used stolen data for extortion or to access personal information and trade secrets.
The Role of Laptop Farms
A key part of the scheme relies on laptop farms. These are locations, often an accomplice's residence, where devices are set up and run remotely by North Korean IT workers. The accomplices also manage servers on the workers' behalf, masking their real location while they carry out paid IT work.
According to the advisory, Japan dismantled one such laptop farm this year. "Japanese authorities obtained evidence this cyber actor group transferred several hundred million Japanese yen in cryptocurrency to foreign locations outside of Japan," the document states. Separately, the FBI says it continues to identify and prosecute US-based individuals who provide facilitation services to these IT workers.
Indicators of Compromise and Deception
The advisory describes telltale signs that exposed operatives. In one case from May 2025, a Japanese cryptocurrency exchange turned down a suspicious applicant. The candidate applied through a VPN with a resume claiming expertise in over ten areas across programming, blockchain, and cloud services. He claimed a European university degree and vast job experience across Europe and Asia.
During a video interview, the applicant said he was born in Malaysia, lived in Finland, and spoke Malay and Chinese as native languages. His English, the advisory notes, "did not match his claimed academic and professional background," and he could not explain most skills on his resume.
Interviewers reported similar patterns with other suspected North Korean IT workers. These included reluctance to meet in person, requests for cryptocurrency payments, and applicants appearing to glance at a second screen as if reading answers. Some calls featured unexplained background voices or repeated audio and video freezes.
WaterPlum operators frequently used AI face-swapping during initial video calls, cutting their feeds minutes into the interview under the guise of technical difficulties. Others were observed practicing Japanese pronunciation with text-to-speech tools, relying on free machine-translation services, or stepping away from work on North Korean holidays to watch soccer or play games.
