Skip to content
CertGPS

North Korean WaterPlum Hackers' Global Campaign

North Korean hacking group WaterPlum compromised at least 30,000 devices worldwide from December 2025 through July 2026, transferring over $10.7 million in stolen cryptocurrency to North Korea.

Severity awaiting reviewSupply chainZero day
Incident date
Published
Read time
8 min
C
CertGPS

Not independently reviewed

AI-assisted content. Editorial policy · Suggest a correction

View source
On this page

Note: This analysis is based on publicly available information from source article. Facts are clearly separated from technical analysis.

Executive Summary

The "North Korean WaterPlum Hackers' Global Campaign" incident is a significant supply-chain attack that compromised over 30,000 devices in more than 100 countries. The attackers, believed to be from North Korea, used various malware and techniques to infect devices and exfiltrate funds or account credentials from over 7,000 cryptocurrency wallets. The incident resulted in the transfer of approximately 1.7 billion Japanese yen (JPY) in cryptocurrency assets to the Democratic People's Republic of Korea (DPRK). This attack highlights the importance of supply-chain security and the need for organizations to implement robust security measures to prevent such incidents.

The impact of this incident is substantial, with over 30,000 devices affected and over 7,000 cryptocurrency wallets compromised. The attackers' ability to exfiltrate funds and account credentials demonstrates the severity of the attack. This incident serves as a reminder of the importance of supply-chain security and the need for organizations to implement robust security measures to prevent such incidents.

What Happened: Timeline

✅ Verified Facts

  • December 2025: WaterPlum hackers started compromising devices.
  • July 2026: WaterPlum hackers stopped compromising devices.
  • September 19, 2026: Joint law enforcement advisory was released.

Technical Deep Dive

Understanding JavaScript Malware: BeaverTail

What is it?

BeaverTail is a JavaScript malware concealed in npm packages. It is designed to infect devices and exfiltrate sensitive information. The malware uses a combination of techniques, including code injection and API hooking, to achieve its goals.

How does it work?

BeaverTail works by injecting malicious code into the victim's device. The malware uses API hooking to intercept and modify system calls, allowing it to exfiltrate sensitive information. The malware also uses code injection to inject malicious code into the victim's device.

Security considerations

BeaverTail is a significant threat because it can be used to exfiltrate sensitive information from devices. The malware's ability to inject malicious code and intercept system calls makes it a powerful tool for attackers. Organizations should implement robust security measures to prevent the spread of BeaverTail and other similar malware.

Understanding Python-based Backdoor: InvisibleFerret

What is it?

InvisibleFerret is a Python-based backdoor used by the WaterPlum hackers. It is designed to provide remote access to the attacker's device, allowing them to exfiltrate sensitive information and take control of the device.

How does it work?

InvisibleFerret works by establishing a connection between the attacker's device and the victim's device. The malware uses a combination of techniques, including encryption and steganography, to hide its presence and avoid detection.

Security considerations

InvisibleFerret is a significant threat because it can be used to exfiltrate sensitive information and take control of devices. The malware's ability to establish a connection between devices makes it a powerful tool for attackers. Organizations should implement robust security measures to prevent the spread of InvisibleFerret and other similar malware.

Understanding JavaScript Remote-Access Trojan and Information Stealer: OtterCookie

What is it?

OtterCookie is a JavaScript remote-access trojan (RAT) and information stealer used by the WaterPlum hackers. It is designed to provide remote access to the attacker's device, allowing them to exfiltrate sensitive information and take control of the device.

How does it work?

OtterCookie works by establishing a connection between the attacker's device and the victim's device. The malware uses a combination of techniques, including encryption and steganography, to hide its presence and avoid detection.

Security considerations

OtterCookie is a significant threat because it can be used to exfiltrate sensitive information and take control of devices. The malware's ability to establish a connection between devices makes it a powerful tool for attackers. Organizations should implement robust security measures to prevent the spread of OtterCookie and other similar malware.

Analysis: What Went Wrong

📊 Professional Analysis

Technical Root Cause

The technical root cause of the incident is the use of JavaScript malware concealed in npm packages (BeaverTail). The malware was able to infect devices and exfiltrate sensitive information due to a combination of factors, including the use of code injection and API hooking.

Contributing Factors

The contributing factors to the incident include the use of Python-based backdoor (InvisibleFerret) and JavaScript remote-access trojan and information stealer (OtterCookie). The attackers' ability to use these malware tools to exfiltrate sensitive information and take control of devices made the incident more severe.

Lessons for Security Professionals

Key Takeaways

  1. Implement robust security measures: Organizations should implement robust security measures to prevent the spread of malware and other similar threats.
  2. Monitor for suspicious activity: Organizations should monitor for suspicious activity, including code injection and API hooking.
  3. Use secure coding practices: Developers should use secure coding practices, including code review and testing, to prevent the introduction of malware.

Prevention & Detection

How to Prevent

  • Implement robust security measures: Organizations should implement robust security measures, including firewalls, intrusion detection systems, and antivirus software.
  • Monitor for suspicious activity: Organizations should monitor for suspicious activity, including code injection and API hooking.
  • Use secure coding practices: Developers should use secure coding practices, including code review and testing, to prevent the introduction of malware.

How to Detect

  • Monitor system logs: Organizations should monitor system logs for suspicious activity, including code injection and API hooking.
  • Use intrusion detection systems: Organizations should use intrusion detection systems to detect and prevent malware attacks.
  • Use antivirus software: Organizations should use antivirus software to detect and prevent malware attacks.
View related certification topics

Security+ (CompTIA)

  • Security+ covers the basics of security, including risk management, vulnerabilities, and malware.
  • Security+ also covers the importance of secure coding practices, including code review and testing.

CySA+ (CompTIA)

  • CySA+ covers the importance of security operations, including incident response and threat hunting.
  • CySA+ also covers the importance of secure coding practices, including code review and testing.

CEH (EC-Council)

  • CEH covers the basics of hacking and penetration testing, including malware and vulnerability exploitation.
  • CEH also covers the importance of secure coding practices, including code review and testing.

CISSP (ISC2)

  • CISSP covers the importance of security and risk management, including risk assessment and mitigation.
  • CISSP also covers the importance of secure coding practices, including code review and testing.

OSCP (Offensive Security)

  • OSCP covers the basics of penetration testing, including malware and vulnerability exploitation.
  • OSCP also covers the importance of secure coding practices, including code review and testing.

CISM (ISACA)

  • CISM covers the importance of information security management, including risk assessment and mitigation.
  • CISM also covers the importance of secure coding practices, including code review and testing.

CISM (ISACA)

  • CISM covers the importance of information security management, including risk assessment and mitigation.
  • CISM also covers the importance of secure coding practices, including code review and testing.

AWS Security (AWS)

  • AWS Security covers the importance of cloud security, including risk assessment and mitigation.
  • AWS Security also covers the importance of secure coding practices, including code review and testing.

AZ-500 (Microsoft)

  • AZ-500 covers the importance of cloud security, including risk assessment and mitigation.
  • AZ-500 also covers the importance of secure coding practices, including code review and testing.

GPEN (GIAC)

  • GPEN covers the basics of penetration testing, including malware and vulnerability exploitation.
  • GPEN also covers the importance of secure coding practices, including code review and testing.

GCIH (GIAC)

  • GCIH covers the basics of hacking and penetration testing, including malware and vulnerability exploitation.
  • GCIH also covers the importance of secure coding practices, including code review and testing.

CSSLP (ISC2)

  • CSSLP covers the importance of software security, including secure coding practices and code review.
  • CSSLP also covers the importance of risk assessment and mitigation.

GCP Security (Google)

  • GCP Security covers the importance of cloud security, including risk assessment and mitigation.
  • GCP Security also covers the importance of secure coding practices, including code review and testing.

CCNP Security (Cisco)

  • CCNP Security covers the importance of network security, including risk assessment and mitigation.
  • CCNP Security also covers the importance of secure coding practices, including code review and testing.

OCI Security (Oracle)

  • OCI Security covers the importance of cloud security, including risk assessment and mitigation.
  • OCI Security also covers the importance of secure coding practices, including code review and testing.

CPTS (CompTIA)

  • CPTS covers the basics of security, including risk management, vulnerabilities, and malware.
  • CPTS also covers the importance of secure coding practices, including code review and testing.

CDSA (CompTIA)

  • CDSA covers the basics of security, including risk management, vulnerabilities, and malware.
  • CDSA also covers the importance of secure coding practices, including code review and testing.

eJPT (Offensive Security)

  • eJPT covers the basics of penetration testing, including malware and vulnerability exploitation.
  • eJPT also covers the importance of secure coding practices, including code review and testing.

eCPPT (Offensive Security)

  • eCPPT covers the basics of penetration testing, including malware and vulnerability exploitation.
  • **

Source (1)

This analysis is based on: https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/

This incident analysis is provided for educational purposes. Facts are cited from the source article, while technical analysis represents professional interpretation.