<![CDATA[North Korean WaterPlum hackers infected 30,000 devices worldwide]]>

<![CDATA[North Korean WaterPlum hackers infected 30,000 devices worldwide]]>A joint law enforcement advisory has exposed a large-scale campaign by the North Korean hacking group WaterPlum, which compromised at least 30,000 devices worldwide between December 2025 and July 2026. According to the advisory, the operation moved more than $10.7 million in stolen cryptocurrency to North Korea.

The campaign's scale and its direct funding link to the regime make it a significant case for defenders tracking state-sponsored financial theft operations. Victims span multiple regions, underscoring that this was not a narrowly targeted intrusion but a broad, sustained effort over roughly eight months.

Key points from the advisory:

Threat actor: WaterPlum, attributed to North Korea
Compromised devices: at least 30,000 globally
Active window: December 2025 to July 2026
Proceeds: over $10.7 million in cryptocurrency transferred to North Korea

Organizations should review their exposure and monitor for activity consistent with this campaign, particularly around cryptocurrency-related infrastructure and endpoints that may have been targeted during the stated timeframe.

Source: BleepingComputer

Has your organization assessed its exposure to this campaign, and what steps are you taking to detect or mitigate it?

]]>https://xploitlk.com/topic/391/north-korean-waterplum-hackers-infected-30-000-devices-worldwideRSS for NodeTue, 27 Oct 2026 09:02:31 GMTSat, 19 Sep 2026 14:30:20 GMT60