DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

Developers and professionals involved in blockchain-related projects.

Date (as written)
17/03/2026
Year
2026
Country
Global
Actors (as written)
WaterPlum (part of the Contagious Interview Campaign from North Korea)
Actor pages
WaterPlum
Tags (as written)
Attack: Malware; Target Class: Fintech; Attack Class: Cyber Espionage Cyber Crime; Initial Access: Social Engineering

Source entries (1)

Hackmageddon cyber attacks timelines (Paolo Passeri)

Developers and professionals involved in blockchain-related projects. · 17/03/2026
Researchers from NTT Security Japan discover that WaterPlum shifted to a new modular malware named "StoatWaffle." The group uses deceptive VSCode configurations in repositories to trick users into executing malicious code, which then downloads Node.js modules to steal browser credentials and gain remote access. [Date Occurred: Since December 2025; Date Discovered: Since December 2025]
https://www.hackmageddon.com/2026/04/14/16-31-march-2025-cyber-attacks-timeline/
https://thehackernews.com/2026/03/north-korean-hackers-abuse-vs-code-auto.html

Suggest a correction on GitHub