The incident information comes through a Bits.media report.

WaterPlum, a North Korean hacking group, infected about 30,000 devices through fake job offers and stole data from 7,000 cryptocurrency wallets.

Its main targets were web developers, engineers, and cryptocurrency and blockchain specialists.

During interviews and test assignments, candidates were asked to download files from collaboration platforms and code repositories, and after infection, the hackers gained persistent remote access to their computers.

Claim check:

  • WaterPlum infected about 30,000 devices through fake job offers and stole data from 7,000 cryptocurrency wallets. (confirmed only by the carrying publication: evidence; «Северокорейская хакерская группировка WaterPlum с помощью фейковых вакансий заразила около 30 000 устройств, похитила данные 7000 криптокошельков и украла $10,8 млн, сообщают правоохранительные органы Германии.»)
  • WaterPlum’s main targets were web developers, engineers, and cryptocurrency and blockchain specialists. (confirmed only by the carrying publication: evidence; «Основными целями хакеров названы веб-разработчики, инженеры, специалисты по криптовалютам и блокчейну.»)
  • During interviews and test assignments, candidates were asked to download files from collaboration platforms and code repositories, and after infection, the hackers gained persistent remote access to their computers. (confirmed only by the carrying publication: evidence; «Во время собеседований и тестовых заданий кандидатам предлагали скачать файлы с платформ совместной разработки и репозиториев кода. В файлах скрывалось вредоносные программы под названием BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, рассказали полицейские. После заражения хакеры получали постоянный удаленный доступ к компьютеру.»)

Publications:

score 64.3 out of 100 · kind: incident