North Korea's 'WaterPlum' Hackers Hit 30,000 Devices Across 100 Countries

Tom's Hardware, citing the advisory, reported that more than 30,000 devices across 100 countries have been infected and over 7,000 cryptocurrency wallets compromised, with losses totaling $10.71 million. According to that report, the attacks begin when fake recruiters ask genuine applicants to complete coding assignments and skills tests. Those files often contain hidden malware that grants the attackers access to a victim's computer, allowing them to steal credentials, personal data and cryptocurrency holdings.

Tom's Hardware also reported that the stolen funds are believed to have been directed to the Democratic People's Republic of Korea, which additionally uses fake IT workers placed at legitimate companies to generate an estimated $500 million a year. The stolen credentials and personal data are later used to apply for positions at Western firms. Amazon has reportedly blocked more than 1,800 suspected North Korean applications since April 2024.

The open-source crypto payment processor says attackers have drained hot wallets on servers running version 2.4.1 and earlier, and is urging users to update.