[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUnKCILZS1AqnEKkVNUpql1nj2FJibLFdDvHuafBORDw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":56},"bd949175-839f-4363-ab84-2bde66c60196","north-korean-hackers-exploit-job-seekers-to-steal-crypto-and-data","20402449-e761-4109-8dc8-03e4dd3bbe29","North Korean Hackers Exploit Job Seekers to Steal Crypto and Data","The WaterPlum hacking group, linked to North Korea, is conducting a sophisticated social engineering campaign by impersonating employers in the AI and cryptocurrency sectors to lure software developers and IT professionals. Victims who engage with fake job offers are tricked into executing malicious code, resulting in device compromise, data theft, and cryptocurrency wallet drainage. This attack highlights the critical danger of supply chain and human-layer vulnerabilities, where trusted professional contexts (job recruitment) are weaponized to bypass technical defenses. The scale — over 30,000 infected devices and $11 million stolen — demonstrates that even technically sophisticated targets fall victim when security awareness is insufficient. Organizations and individuals who conflate professional trust with digital safety create exploitable blind spots for state-sponsored threat actors.","**Immediate actions:**\n- Train all employees and contractors to independently verify recruiter identities through official company channels before engaging with any job-related communications or code.\n- Establish a policy prohibiting the execution of any code, scripts, or applications received during a recruitment or interview process on corporate or personal devices.\n\n**Long-term improvements:**\n- Implement endpoint detection and response (EDR) tools on all developer workstations to detect and block suspicious code execution or lateral movement.\n- Conduct regular third-party social engineering assessments targeting technical staff, especially those active on professional networks like LinkedIn or GitHub.\n- Develop and enforce a vetting process for all third-party contractors and freelance developers, including background checks and sandboxed onboarding environments.\n\n**Detection measures:**\n- Monitor for anomalous outbound network traffic, particularly to cryptocurrency-related endpoints or unknown external IPs, from developer machines.\n- Deploy behavioral analytics to flag unusual access patterns to sensitive repositories, crypto wallets, or credential stores following any external recruitment interaction.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 14 – Security Awareness and Skills Training","CIS Control 10 – Malware Defenses","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST SP 800-53 SA-12 – Supply Chain Protection","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST CSF PR.AT-1 – User Awareness","NIST CSF ID.SC-2 – Supply Chain Risk Management","MITRE ATT&CK T1566.003 – Phishing via Job Lure","GDPR Article 32 – Security of Processing (for affected EU data subjects)",{},"published","2026-09-18T16:20:24.757219+00:00","2026-09-18T16:20:24.178+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fcyberscoop.com\u002Fnorth-korea-waterplum-job-seeker-crypto-attacks\u002F","international-security-agencies-warn-about-north-korean-hackers-exploiting-job-s-cd07e8","International security agencies warn about North Korean hackers exploiting job seekers to steal crypto, data",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[44,50],{"id":45,"date":46,"edition":47,"title":48,"audio_url":49},"e4ddf157-8a72-499f-ab71-e2da6f4258e8","2026-09-20","afternoon","ThreatNoir Weekend Brief — September 20","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-20\u002Fthreatnoir-afternoon-brief-2026-09-20.mp3",{"id":51,"date":52,"edition":53,"title":54,"audio_url":55},"720d8f46-1f79-4b3b-8389-af7d6c8e8bef","2026-09-19","morning","ThreatNoir Weekend Brief — September 19","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-19\u002Fthreatnoir-morning-brief-2026-09-19.mp3",[57,61,65],{"slug":58,"name":59,"problem":60},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":62,"name":63,"problem":64},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":66,"name":67,"problem":68},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]