North KoreaAttributedDPRK 313 General BureauMixedActive 2023 – 2026Contagious Interview
Also known asDEV#POPPER · Tenacious Pungsan · WaterPlum · PurpleBravo · DeceptiveDevelopment · Gwisin Gang · TAG-121 · Void Dokkaebi · UNC5342 · NICKEL ALLEY
Summary
North Korean group that poses as employers to infect software developers and IT professionals during fake job interviews — Japan's NPA, the FBI and four partner agencies call it WaterPlum, 'commonly referred to as Contagious Interview' (Sep 2026). Victims are told to run coding tests or fix a 'broken' video-call client from attacker repositories and npm packages carrying BeaverTail, InvisibleFerret, OtterCookie, OtterCandy or StoatWaffle, followed by RATs and wallet/credential stealers. From about December 2025 to July 2026 it infected at least 30,000 PCs in 100+ countries and took funds or credentials from over 7,000 crypto wallets, moving ¥1.7B (~$10.71M) to the DPRK. The NPA and FBI assess that it and some North Korean IT workers sit under the 313 General Bureau of the Munitions Industry Department, and some WaterPlum operators also work as IT workers. The remote-IT-worker revenue program itself is tracked separately here as Jasper Sleet; CrowdStrike's FAMOUS CHOLLIMA covers both. BSI (April 2026) lists the actor as active against German organisations.
Attribution
Munitions Industry Department, WPK Central Committee
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- Japan NPA, FBI and partners (Government, 2026-09-18)
Assess WaterPlum operates under the 313 General Bureau, Munitions Industry Department - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
North Korea-aligned
Campaigns 5
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Developer supply-chain spillover — poisoned npm, Go, Packagist, PyPI and extension packages | 2026-04 – 2026-09 | Global | Software Development, Technology | ESET Research (2026-10-28) — as DeceptiveDevelopment (an alias on this record) |
| WaterPlum fake-employer coding interviews — 30,000+ PCs, 7,000+ wallets (six-agency advisory) | 2025-12 – 2026-07 | Japan, USA, Europe, Global | Software Development, Cryptocurrency, Blockchain, Web3, Freelance IT | NPA/FBI/DC3/ASD ACSC/BND/BfV joint advisory (2026-09-18) |
| Fake developer interviews — OtterCookie / JS beaconing agent / FlexibleFerret wave | 2025-10 – ongoing | Global | Technology, Media | Microsoft Defender Experts (2026-03-11) |
| Germany — financial-services targeting via fake job applicants / IT freelancers (BSI listing) | 2024 – 2026-04 | Germany | Financial Services | BSI 'Active APT groups in Germany' (2026-04-14) |
| Contagious Interview Global Campaign | 2023-11 – ongoing | Global | Technology, Cryptocurrency | Unit 42 (2023-11-21) / Mandiant |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 13
| Reconnaissance1 | T1681Search Threat Vendor Data |
|---|---|
| Initial Access1 | T1566.003Spearphishing via Service |
| Execution4 | T1204.002Malicious FileT1059.007JavaScriptT1059.006PythonT1204.005Malicious Library |
| Persistence2 | T1543.001Launch AgentT1547.013XDG Autostart Entries |
| Privilege Escalation1 | T1546.004Unix Shell Configuration Modification |
| Credential Access2 | T1555Credentials from Password StoresT1555.001Keychain |
| Exfiltration1 | T1020Automated Exfiltration |
| Impact1 | T1657Financial Theft |
Malware and tools 10
| Name | Description | Platform |
|---|---|---|
| BeaverTail | JavaScript Infostealer | Cross-platform |
| InvisibleFerret | Python Backdoor | Cross-platform |
| OtterCookie | macOS Loader | macOS |
| FERRETSTEAL | Credential/Wallet Stealer | Cross-platform |
| FlexibleFerret | Modular backdoor (Go/Python) | Cross-platform |
| XORIndex Loader | Malware | Windows |
| HexEval Loader | Malware | Linux/macOS/Windows |
| OtterCandy | Node.js RAT/stealer combining OtterCookie and RATatouille features | Cross-platform |
| StoatWaffle | Modular Node.js loader, credential harvester and RAT delivered via auto-running VS Code project configs | Cross-platform |
| OmniStealer | Infostealer (Python) | windows/linux/macOS |
Infrastructure patterns
- Fake email, LinkedIn and code-repository accounts behind its recruiter personas (MITRE ATT&CK, 2026)
- C&C IP read from Ethereum transactions (NullReceiver) — switched without a package update (ESET, 2026)
- Lures on self-hosted Gitea; payloads on JSONBin.io, JSONHosting and Pinata IPFS (ESET, 2026)
Reporting and advisories 6
- BSI
Active APT Groups in Germany (April 2026) - Unit 42 / Mandiant
Contagious Interview Global Campaign - Microsoft Defender Experts
Fake developer interviews — OtterCookie / JS beaconing agent / FlexibleFerret wave - NPA/FBI/DC3/ASD ACSC/BND/BfV joint advisory
WaterPlum fake-employer coding interviews — 30,000+ PCs, 7,000+ wallets (six-agency advisory) - MITRE ATT&CK
Contagious Interview (G1052) group profile - ESET Research
ESET APT Activity Report Q2–Q3 2026 (Oct 2026)