DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

Japan NPA/NCO, US FBI/DC3, Australia ASD's ACSC, Germany BND/BfV joint public attribution: "North Korean WaterPlum (Contagious Interview) Cyber Actor Group Targeting IT Professionals; Activities of North Korean IT Workers in Japan, the United States and Europe" (September 18, 2026) (4)

Date (as written)IncidentCountryActors
From around December 2025 through July 2026WaterPlum / Contagious Interview fake job-interview malware campaign (30,000 PCs, 100+ countries)WaterPlum ("Contagious Interview")
In May 2025Suspected North Korean IT worker application to a Japanese cryptocurrency exchange (not hired)Japansuspected North Korean IT worker
(as of September 18, 2026)First laptop farm dismantled in JapanJapanNorth Korean IT workers; WaterPlum
(not dated)IT worker extortion with published source code; IT worker website defacementNorth Korean IT workers