North Korea's fake job interviews infected 30,000 devices

North Korea's employment scams work both ways.

As well as placing fraudulent IT workers inside Western companies, regime-backed cybercriminals have posed as recruiters to infect more than 30,000 devices and steal over $10 million, according to an international advisory.

Law enforcement and cybersecurity agencies from Australia, Germany, Japan, and the US issued an update on the campaign on Thursday.

They said the attackers had compromised more than 7,000 cryptocurrency wallets and stolen funds that ultimately supported the North Korean regime.

The agencies track the activity collectively as WaterPlum.

Its operators target web designers, engineers, and cryptocurrency and Web3 specialists with bogus recruitment approaches.

During the supposed interview process, victims are instructed to download files presented as coding assignments or other recruitment tests.

Opening them backdoors the applicants' computers and installs malware.

Once inside, the attackers deploy remote access trojans (RATs) and information stealers, giving them persistent access to credentials and other sensitive data long after the fake interview ends.

In some cases, the compromised machines may later provide a route into corporate systems when the jobseekers secure legitimate employment.

WaterPlum operators use that access to steal intellectual property, credentials, clipboard contents, keystrokes, cryptocurrency wallet data, and identity documents that can support further impersonation.

"Stolen IDs can be used by North Korean IT workers to impersonate victims and generate foreign currency," the advisory [PDF] said.

"Stolen credentials may be leveraged to exfiltrate crypto assets, personal data, trade secrets, etc., from victims' employers, clients, or contracting parties.

The actors can also use stolen sensitive information for extortion." The agencies attributed at least $10.71 million in thefts to these tactics, with the proceeds funneled to Pyongyang.