WaterPlum Campaign

The cluster covers a cyberespionage campaign attributed to WaterPlum, a North Korean-linked hacking operation. The attackers reportedly used fraudulent recruitment and job-interview interactions as the entry point, targeting people who might be willing to install software, open files, or follow instructions during a hiring process. Those interactions enabled malware to reach roughly 30,000 devices around the world, turning an ordinary professional opportunity into a delivery mechanism for malicious code.

The campaign illustrates how attackers increasingly exploit trust and social engineering rather than relying only on technical vulnerabilities. Fake recruiters can make an operation appear credible, while interview-related tasks provide a plausible reason to request applications, coding exercises, communications tools, or other downloads. Security researchers are tracking the activity and linking the campaign to North Korean operators, while potential victims and organizations are urged to verify recruiters independently, avoid untrusted software, and monitor devices involved in job searches. The reported scale highlights the global reach of employment-themed attacks and the difficulty of distinguishing legitimate remote hiring from a carefully staged intrusion.