OAK — OnChain Attack Knowledge

Worked example · 2026-09

WaterPlum / Contagious Interview — seven agencies in four countries put numbers on the fake-recruiter campaign: 30,000 machines, 7,000 wallets, ¥1.7B — developers and IT freelancers worldwide — 2025-12 → 2026-07 (attributed 2026-09-18)

Loss
at least ¥1.7B (~$10.71M) in cryptocurrency transferred to the DPRK from over 7,000 wallets whose funds or credentials were exfiltrated, across at least 30,000 compromised PCs in more than 100 countries, between around December 2025 and July 2026. These are the advisory's figures, stated as minimums. Separately, Japanese investigators found evidence that the group moved several hundred million yen abroad through a laptop farm run by an enabler in Japan — the first such farm identified and dismantled in Japan.
OAK Techniques observed
OAK-T4.013 (Endpoint Infostealer Wallet-Material and Credential Exfiltration — primary for the attested loss. The advisory's measured harm is to individual web designers, engineers and crypto / blockchain / Web3 specialists, whose own wallets — "private key, seed phrase, etc." — were taken from their own machines by BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle, alongside browser credentials, clipboard, keystrokes and screenshots. See techniques/T4.013-endpoint-infostealer-wallet-credential-exfiltration.md). OAK-T15.001 (Social Engineering of Operator Personnel — the pretext, in its fake-recruiter / fake-coding-test sub-shape. Fake employers, often impersonating real AI, crypto and NFT companies, approach developers on social, job, gig and freelance platforms and have them run code from a repository to "complete a coding assignment" or "fix an error in the video-conferencing platform." T15.001 is the operator-side mapping, and the advisory names the operator-side follow-on explicitly: infections give the actors a route into the organisations that employ the targeted developers. See techniques/T15.001-social-engineering-of-operator-personnel.md). OAK-T15.003 (Operator-Endpoint Compromise — the RAT persistence and pivoting the advisory describes once a loader runs).
Attribution
confirmed — joint public attribution dated 2026-09-18 by Japan's National Police Agency and National Cybersecurity Office, the FBI and the DoD Cyber Crime Center (DC3), Australia's ASD's ACSC, and Germany's BND and BfV. The NPA and FBI assess that WaterPlum and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department of the Workers' Party Central Committee; WaterPlum actors and IT workers used the same IP addresses for laptop-farm access, crowdsourcing work and a job application to a Japanese exchange. This ties the campaign to OAK-G04 (DPRK IT-Worker Placement Scheme) by shared infrastructure and command, in addition to the cluster-level Lazarus association the malware pages already carry. TTP discovery credited to the Kanto Regional Police Bureau's National Cyber Department, prefectural police, the FBI and private partners; NTT Security Japan and bitFlyer are acknowledged.
Key teaching point
"Run this repository" is the payload, and the job interview is only the delivery envelope. Every variant in the advisory ends in the target executing someone else's code on the machine that holds their keys — an npm package, a Python backdoor, or a VS Code project whose .vscode/tasks.json runs automatically when the folder is opened and trusted. That last trigger needs no command from the victim at all beyond clicking "Yes, I trust the authors." The controls are correspondingly mechanical: never run interview code on a machine that holds wallet material or employer credentials; open unknown projects in VS Code Restricted Mode and read tasks.json first; and after any suspected infection, assume the seed is gone — move funds to a new wallet created on a different device rather than cleaning the old one.

One lure, two victim classes. The same approach lands on a freelancer whose only asset is their own wallet (T4.013) and on an exchange engineer whose laptop signs for customers (T15.001 → T15.003). OAK's split between end-user and operator-personnel is decided by what the compromised machine controls, not by the lure, so a campaign at this scale necessarily straddles both. The ¥1.7B is the end-user side; the employer-side damage the advisory warns about is not quantified.

Not a second anchor for the T15.007 candidate (Fabricated Institutional Identity as Pretext Substrate). The advisory confirms at government level that the actors "impersonate legitimate Artificial Intelligence (AI), cryptocurrency, or Non-Fungible Token (NFT) companies" — the pattern T15.007 describes — but carries none of the primary evidence of the identity itself (domain registration dates, account creation dates, employer confirmation) that the candidate's promotion bar requires. Recorded as corroboration.

Summary

WaterPlum is the government name for the long-running DPRK campaign industry calls Contagious Interview. Its operators pose as employers, move candidates to "technical interviews" or "coding assignments," and have them download and run malicious code from collaboration and repository platforms. The code carries loaders and stealers — BeaverTail (JavaScript in npm packages), InvisibleFerret (Python backdoor), OtterCookie (JavaScript RAT/stealer), OtterCandy (OtterCookie combined with RATatouille) and StoatWaffle (modular Node.js loader, stealer and RAT delivered through malicious VS Code projects that use blockchain-themed repositories as decoys).

The joint advisory adds three things vendor reporting could not: scale measured by law enforcement (30,000+ PCs, 100+ countries, 7,000+ wallets, ¥1.7B), command attribution (313 General Bureau, shared with part of the IT-worker scheme), and infrastructure overlap between the hacking campaign and IT-worker job applications — including an application to a Japanese crypto exchange in May 2025 that the exchange spotted and rejected.

Observed operator behaviour recorded by the advisory: AI face-swapping in video interviews, with the camera dropped after a few minutes on a claimed network problem; Japanese pronunciation practised with text-to-speech; free machine-translation and AI plans; and no operational activity on North Korean public holidays.

Timeline

When Event OAK ref
2023-07 onward BeaverTail / InvisibleFerret documented by vendors under the "Contagious Interview" name (prior record — OAK-S29, OAK-S30)
2025-05 Suspected DPRK IT worker applies to a Japanese crypto exchange via VPN with a forged résumé; not hired (G04 — prevented)
~2025-12 → 2026-07 ≥30,000 PCs compromised in 100+ countries; >7,000 wallets drained or credentials taken; ≥¥1.7B to DPRK T15.001 pretext → T4.013
2026-08-27 OAK field-collects a live lure from this campaign shape against its own maintainer; not executed (first-party specimen)
2026-09-18 Joint public attribution by NPA, NCO, FBI, DC3, ASD's ACSC, BND, BfV; Japanese laptop farm dismantled (attribution)

What defenders observed

  • The trigger keeps moving off the command line. The advisory lists npm packages and, newly, VS Code workspace tasks that auto-run on trust. OAK's own specimen used npm prepare with no payload in the repository. Detection that keys on the victim typing a suspicious command misses both.
  • The shell-string list is concrete and cheap to enforce. The advisory names curl, base64, -enc, mshta, Invoke-WebRequest -Uri, iwr -Uri and hidden as strings that should stop a candidate from running an interview script. That is a pre-commit or EDR rule, not a training slide.
  • Hiring pipelines are an intrusion surface in both directions. The same infrastructure applied to a Japanese exchange as a candidate and approached developers as an employer. Exchange HR and developer job-seeking are the same attack surface seen from two sides.
  • Video is no longer identity. Face-swap in the first minutes, then "network problems," is recorded by government investigators as observed behaviour, not speculation.

Public references

Discussion

This entry records a campaign, not an incident, and its value to OAK is attestation rather than loss. The fake-recruiter sub-shape of T15.001 already had its canonical anchors — Ronin, DMM Bitcoin, Drift — and a first-party specimen. What it lacked was independent, multi-source confirmation at the level of the pattern rather than of a single intrusion. A joint attribution by seven agencies in four countries, with law-enforcement-measured scale, is that confirmation, and it is the basis on which T15.001 is promoted to stable in the same change as this file.

Three things are deliberately left for later rather than done here. OtterCookie, OtterCandy and StoatWaffle have no software pages yet; the advisory describes each only in a footnote, which is enough to name them and not enough to write them. The G01 / G04 boundary needs a proper review: OAK files Contagious Interview's malware under the Lazarus cluster and IT workers under G04 as operationally distinct, and a government finding that both answer to the same bureau and share IP space argues that the distinction is organisational rather than one of actor. And the employer-side damage — the corporate compromises that began as a developer's coding test — is unquantified, so no figure for it is recorded.

Techniques demonstrated (3)