Japan Dismantles First North Korean Laptop Farm

Japanese authorities have dismantled a “laptop farm” operated by North Korean threat actors, marking the first confirmed takedown of its kind in the country. The discovery was part of a broader investigation detailed in a joint advisory released by intelligence and law enforcement agencies from Japan, the United States, Australia, and Germany.

The advisory identifies the threat actor as WaterPlum, also known as Contagious Interview. The group has been conducting a long-running scheme targeting software developers, engineers, and specialists in blockchain, cryptocurrency, and Web3 technologies.

Scale of the WaterPlum Campaign

Between December 2025 and July 2026, WaterPlum reportedly infected at least 30,000 devices across more than 100 countries. The group poses as legitimate employers or uses established recruiting services to contact targets, often impersonating companies in the artificial intelligence (AI), cryptocurrency, or NFT sectors.

The financial impact of the campaign is significant. Authorities estimate that roughly $10.71 million was diverted to North Korea, following the theft of funds or credentials from more than 7,000 cryptocurrency wallets. Beyond direct theft, the group uses compromised developer accounts to gain access to corporate networks, steal trade secrets, or facilitate extortion.

The National Police Agency of Japan and the FBI have linked the WaterPlum operators to the 313 General Bureau of the Munitions Industry Department, an entity under the Workers’ Party of Korea’s Central Committee.

The Role of Laptop Farms

A central component of this operation involves the use of “laptop farms.” These are locations, frequently the residences of accomplices, where multiple devices are set up to be operated remotely by North Korean IT workers. This setup allows the workers to mask their true location and apply for jobs or perform legitimate IT work while appearing to be based elsewhere.

The recent dismantling in Japan included evidence that several hundred million Japanese yen in cryptocurrency were transferred to foreign locations outside of the country.

Deception and AI-Assisted Fraud

WaterPlum employs sophisticated social engineering and technological deception to pass employment screenings. The advisory notes that operatives have frequently used AI face-swapping during initial video interviews to hide their identities. These actors often end calls abruptly, citing technical difficulties, once they have evaded initial detection.

Recruiters have identified several red flags during the hiring process, including:

• Inconsistent profiles: Candidates claiming vast expertise across many programming languages and cloud services that do not align with their academic or professional backgrounds.
• Linguistic discrepancies: Applicants whose spoken English or other languages do not match their claimed education or residency history.
• Suspicious interview behaviour: Candidates appearing to read answers from a second screen, experiencing frequent unexplained audio or video freezes, or having unexplained background voices.
• Payment requests: A strong preference for being paid in cryptocurrency.

The FBI continues to investigate and prosecute individuals within the United States who provide facilitation services to North Korean IT workers.