WaterPlum
aka Contagious Interview, Famous Chollima
A North Korean group that lures engineers with fake job offers and coding interviews, gets them to run booby-trapped code, and steals crypto and credentials. It is also tied to North Korean IT workers taking contracts from Japanese firms.
- Alert level
- 2/ 5
- Reports & advisories (90 days)
- 0
- Known exploited CVEs
- 0
- Personal data leaked (disclosed)
- None confirmed
Attribution
- Assessed as operating under the 313 General Bureau of North Korea's Munitions Industry Department — Japan's NPA and NCO, US FBI and DC3, Australia and Germany
How they attack
Entry
Fake job offers and interviews
Like a recruiter with a dream job who asks you to open a 'test assignment' that is actually booby-trapped.
Entry
Planting poisoned code packages
Like handing out handy spare parts for a toolbox that each hide a listening device.
Goal
Stealing cryptocurrency
Like taking over the vault keeper's computer and opening the vault while pretending to be them.
Goal
Working under false identities
Like someone borrowing another person's ID and remotely operating a company laptop from abroad to collect a salary.
Sources
Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.
Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.
The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.
Updated 2026-10-23 · daily