Two sources describe a North Korean campaign known as WaterPlum. Recruiters posed as AI or blockchain employers and sent coding tests that installed backdoors on jobseekers' machines. The Register puts the infection count at 30,000 devices and says the actors drained more than 7,000 crypto wallets; Recorded Future News reports the campaign reached over 100 countries and cites a joint advisory from the FBI, the US Department of Defense, Japan's National Police Agency, and agencies in Australia and Germany.
The two accounts agree on the core tactics and impact, though The Register offers the specific device and wallet figures while Recorded Future News stresses the international scope. Neither article links WaterPlum to other North Korean activity.
A third source, Dark Reading, covers a different likely North Korean APT operation targeting South Korean media and automotive sectors. That campaign used an undocumented Linux espionage toolkit to compromise load balancers and intercept communications. The sources describe separate efforts rather than one unified campaign.