North Korean hackers use fake job interviews to target IT professionals

What happened

Japan’s National Police Agency and National Cybersecurity Office, the US FBI and DC3, Germany’s BND and BfV, and the ASD’s ACSC released a joint advisory about a North Korean group known as WaterPlum, also called Contagious Interview.

According to the advisory, the group poses as employers, often pretending to be AI, cryptocurrency or NFT companies, to target software developers and IT professionals. They have infected at least 30,000 devices in more than 100 countries and stolen from over 7,000 cryptocurrency wallets.

How the fake interview works

• A “recruiter” makes contact on LinkedIn, a freelance platform or a job site with an attractive role.
• After a friendly chat, the candidate is given a coding test or project to download and run, or asked to install a video call tool.
• The code or tool contains malware that steals credentials, browser data and cryptocurrency, and can give the attackers ongoing access to the computer.

The other risk: hiring a fake worker

The advisory also describes North Korean IT workers who use false identities, stolen documents and “laptop farms” to get remote jobs and contracts. The money funds the North Korean regime, and some use their access to steal data. Some WaterPlum members also work as developers for real clients.

For job seekers

• Be wary of unsolicited offers that move quickly to a technical test.
• Never run code from an unknown party on your everyday computer. If you must review a test, use an isolated virtual machine or a separate device with nothing sensitive on it.
• Verify the company and recruiter through the company’s official website.
• Treat any request to install unfamiliar meeting software with suspicion.

For employers and anyone hiring contractors

• Verify identity and work history properly before giving anyone access to code or systems. Use video interviews with cameras on and check references independently.
• Watch for warning signs: reluctance to appear on camera, inconsistent details, requests to ship equipment to a different address, or payment to accounts in other names.
• Give new contractors only the access they need, and monitor for unusual activity.
• See our guides on staff onboarding and offboarding and questions for suppliers.

Where to get help

If you think you’ve run a malicious test or hired someone under a false identity, disconnect affected devices, change credentials from a clean device, and call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).