[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQZ19fwD89QiY6Yjmty5soHfZtHj4XaB50NZ9pWdQs4A":3},{"article":4,"iocs":54,"watch_terms":70,"solutions":71,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"cd9c5fd6-d930-4cd0-bf05-54f6b52eea55","North Korean WaterPlum hackers infected 30,000 devices worldwide","north-korean-waterplum-hackers-infected-30-000-devices-worldwide-f02d07","A joint law enforcement advisory warns that the North Korean hacking group WaterPlum compromised at least 30,000 devices worldwide from December 2025 through July 2026 and transferred more than $10.7 million in stolen cryptocurrency to North Korea. [...]","A joint advisory from US, Japanese, Australian, and German authorities details the activities of the North Korean hacking group WaterPlum. The group compromised over 30,000 devices globally between December 2025 and July 2026, stealing more than $10.7 million in cryptocurrency and exfiltrating credentials and sensitive data. WaterPlum is linked to the 'Contagious Interview' campaign, using malicious npm packages and impersonating AI\u002Fcrypto companies to target job seekers.","North Korean WaterPlum hackers infected 30,000 devices worldwide and stole over $10.7M in crypto.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnorth-korean-waterplum-hackers-infected-30-000-devices-worldwide\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F08\u002F12\u002Fnorth-korean-hackers.jpg","2026-09-19T14:05:15+00:00","2026-09-19T18:00:06.789688+00:00",9,[17,20,23,26,29],{"name":18,"type":19},"WaterPlum","threat_actor",{"name":21,"type":22},"Contagious Interview","campaign",{"name":24,"type":25},"Microsoft","vendor",{"name":27,"type":28},"npm","technology",{"name":30,"type":28},"Visual Studio Code","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":31,"icon":33,"name":34,"slug":35},null,"Nation-state","nation-state",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,58,61,64,67],{"type":48,"value":56,"context":57},"BeaverTail","JavaScript malware concealed in npm packages",{"type":48,"value":59,"context":60},"InvisibleFerret","Python-based backdoor",{"type":48,"value":62,"context":63},"OtterCookie","JavaScript remote-access trojan and information stealer",{"type":48,"value":65,"context":66},"OtterCandy","Malware combining OtterCookie and RAT capabilities",{"type":48,"value":68,"context":69},"StoatWaffle","Modular Node.js malware delivered through malicious Visual Studio Code projects",[24],{"controls":72,"vendors":151},[73,101,125],{"slug":74,"name":75,"problem":76,"products":77},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[78,86,94],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":95,"vendor_name":24,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":102,"name":103,"problem":104,"products":105},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[106,113,118],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":107,"product_name":110,"url":111,"description":112},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":114,"product_name":115,"url":116,"description":117},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":102,"product_name":122,"url":123,"description":124},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"slug":126,"name":127,"problem":128,"products":129},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":147,"product_name":148,"url":149,"description":150},"jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[],{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":167},"north-korean-hackers-exploit-fake-npm-packages-and-job-scams-to-compromise-30000-devices","North Korean Hackers Exploit Fake npm Packages and Job Scams to Compromise 30,000 Devices","The WaterPlum group exploited two compounding weaknesses: a poisoned open-source software supply chain via malicious npm packages, and social engineering that preyed on job seekers unaware of impersonation tactics. By embedding malware in packages that developers routinely trust and install, attackers gained immediate footholds on developer workstations with minimal friction. The campaign's success—30,000 devices compromised and $10.7 million stolen—demonstrates how supply chain attacks amplify reach far beyond direct targeting. Organizations that lack vetting processes for third-party packages and employees who cannot recognize recruitment-based social engineering remain critically exposed to this growing attack vector.",[157,158,159,160,161,162,163,164,165,166],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-161 – Supply Chain Risk Management","NIST SP 800-218 – Secure Software Development Framework (SSDF) – PW.4 (Reuse Well-Secured Software)","NIST CSF ID.SC-3 – Suppliers and third-party partners are assessed","NIST AT-2 – Literacy Training and Awareness","NIST SA-12 – Supply Chain Protection","SLSA Framework – Level 2+ for package provenance verification","OpenSSF Scorecard – Dependency risk evaluation for open-source packages","GDPR Article 32 – Security of processing (relevant for EU organizations whose data was exfiltrated)",{}]