China-linked actors target human vulnerabilities to steal US AI technology

Seven agencies from Japan, the United States, Australia and Germany — the National Police Agency, the National Cyber Security Center, the US Federal Bureau of Investigation, the US Department of Defense Cyber Crime Center, the Australian Cyber Security Centre, Germany's Federal Intelligence Service and Germany's Federal Office for the Protection of the Constitution — jointly announced on the 18th the details of cryptocurrency theft by the North Korea-linked cyberattack group WaterPlum. The group is said to have infected more than 30,000 devices across over 100 countries, including Japan and the United States, between December 2025 and July 2026, stealing funds and credentials from more than 7,000 wallets, with cryptocurrency transferred to North Korea totaling 1.7 billion yen, equivalent to 10.71 million dollars. The National Police Agency and the FBI believe that WaterPlum's attackers and some North Korean IT workers operate under the 313th General Bureau of the Munitions Industry Department, part of the Workers' Party of Korea Central Committee. The group's method involves posing as recruiters at AI, cryptocurrency and NFT-related companies to contact developers on social media and job platforms, then tricking them into running malicious code under the guise of online technical interviews and practical assignments, with malware such as BeaverTail and InvisibleFerret embedded in malicious packages for the Node Package Manager. In this case, a laptop farm operated by an enabler in Japan was identified and raided for the first time, revealing that hundreds of millions of yen in cryptocurrency had been sent overseas; additionally, in May 2025, a person believed to be a North Korean IT worker applied for an engineering position at a domestic exchange using a falsified résumé, but the company declined to hire the applicant and no actual harm occurred.