Technology newsroom
Warning! 🚨 North Korean Hackers Use Fake Job Interviews to Embed Malware, Stealing Over $10.7 Million in Crypto
North Korean hacker group WaterPlum uses fake job interview processes and coding tests to embed RAT malware onto software developers' computers, resulting in over 30,000 infected devices and over $10.7 million in cryptocurrency stolen.
📌 Key Highlights:
- North Korean hacker group WaterPlum uses job interview processes and coding tests as a channel to deploy malware.
- Over 30,000 devices in 100 countries have been infected, causing damages exceeding US$10.71 million.
- The embedded malware is a persistent Remote Access Trojan (RAT) that allows long-term control of the device and could be used as a bridge to attack organizations where victims may work in the future.
Cybersecurity agencies from four countries – Japan, the United States, Australia, and Germany – have issued a joint alert regarding a major cyberattack campaign by a North Korean-linked hacker group named WaterPlum. This group primarily targets software developers and IT professionals seeking employment.
WaterPlum's strategy involves creating enticing fake job postings, impersonating real companies in the AI, Cryptocurrency, and NFT sectors. These fake postings are then distributed on online job platforms, social media, and freelance platforms. When interested applicants apply, the hackers impersonate HR personnel and conduct interviews. Subsequently, applicants are asked to complete coding skill tests, and it is within these test files that severe malware is embedded.
🚨 Damages and Attack Methods
The installed malware is a persistent Remote Access Trojan (RAT), allowing hackers continuous remote access and control over victims' computers, even long after the interview process has concluded. Reports indicate that over 30,000 devices in 100 countries have been infected, and more than 7,000 cryptocurrency wallets have been compromised, amounting to damages of US$10.71 million. It is believed that these funds are being sent to support the economically sanctioned government of North Korea (DPRK).
🕵️♂️ Ongoing Threat to Organizations
Beyond stealing cryptocurrency, hackers also steal victims' personal information and credentials to apply for jobs at other companies. For instance, Amazon detected and blocked over 1,800 suspicious applications believed to originate from North Korea. The most concerning threat is that if an applicant whose personal computer has been infected with malware is hired by another company and uses the same computer for work, hackers will then have an easy backdoor to penetrate the new organization's network.
🛡️ Prevention Measures
For those seeking IT jobs, exercise extreme caution. Apply for jobs directly through the company's official website, and if unsure about an open position, contact the company directly for confirmation. The best prevention method when required to perform technical tests is to use an isolated environment, such as setting up a dedicated Virtual Machine (VM) for testing, to prevent malware from spreading to the computer's main system.
💬 Have you encountered any suspicious experiences during online job applications or interviews? Share them to help inform others!