North Korean WaterPlum hackers infected 30,000 devices worldwide
-
A joint law enforcement advisory has exposed a large-scale campaign by the North Korean hacking group WaterPlum, which compromised at least 30,000 devices worldwide between December 2025 and July 2026. According to the advisory, the operation moved more than $10.7 million in stolen cryptocurrency to North Korea.
The campaign's scale and its direct funding link to the regime make it a significant case for defenders tracking state-sponsored financial theft operations. Victims span multiple regions, underscoring that this was not a narrowly targeted intrusion but a broad, sustained effort over roughly eight months.
Key points from the advisory:
- Threat actor: WaterPlum, attributed to North Korea
- Compromised devices: at least 30,000 globally
- Active window: December 2025 to July 2026
- Proceeds: over $10.7 million in cryptocurrency transferred to North Korea
Organizations should review their exposure and monitor for activity consistent with this campaign, particularly around cryptocurrency-related infrastructure and endpoints that may have been targeted during the stated timeframe.
Source: BleepingComputer
Has your organization assessed its exposure to this campaign, and what steps are you taking to detect or mitigate it?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login