← threat actors
threat actor · KP
WageMole
also tracked as famous chollima 3, waterplum 2, lazarus group 2, citrine sleet 1, cryptocore 1, jade sleet 1, moonstone sleet 1, temp hermit 1, lazarus 1
5 stories · 4 in the wild · June 17, 2026 – September 24, 2026
evidence: 4 observed
how they got in
- fake recruiter 4 · Sep 24
- phishing email 1 · Aug 12
sectors
- technology 2 · Sep 24
- crypto 2 · Sep 19
- developers 2 · Sep 19
- defense 2 · Sep 9
- finance 1 · Sep 9
- government 1 · Sep 9
geography
- north korea 5 · Sep 24
- japan 1 · Sep 24
- europe 1 · Aug 12
- india 1 · Aug 12
malware and tools
- beavertail 1 · Sep 19
- invisibleferret 1 · Sep 19
- ottercandy 1 · Sep 19
- ottercookie 1 · Sep 19
- stoatwaffles 1 · Sep 19
- in memory backdoor 1 · Aug 12
- kernel rootkit 1 · Aug 12
techniques
- fake recruiter 2 · Sep 24
- info stealing 1 · Sep 19
- privilege escalation 1 · Aug 12
- rce 1 · Aug 12
attack phases seen
- Initial access 4 · Sep 24
- Collection 1 · Sep 19
- Credential access 1 · Sep 19
- Execution 1 · Sep 19
- Privilege escalation 1 · Aug 12
what we reported, newest first, grouped by story
Sep 9 – September 24, 2026 · 3 reports
- Japan dismantles its first North Korean laptop farm. A joint international advisory ties the WaterPlum campaign to a global fake-employer scheme that infected more than 30,000 devices and stole $10.7 million in cryptocurrency (SecurityWeek) (earlier coverage).
· Sep 24 · observed · via fake recruiter · as waterplum · Threat Activity
- A five-country advisory names "WaterPlum" — FBI and DoD with Japan's National Police Agency and agencies in Australia and Germany. Between December 2025 and July 2026 the North Korean actors infected at least 30,000 devices across 100 countries, took funds or credentials from about 7,000 cryptocurrency wallets, and stole more than $10.5 million, luring web designers, engineers and crypto specialists into downloading files during fake interviews. Japanese police found BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle variants, with infostealers plus RMM tooling kept in place in the hope victims later get hired at target firms (The Record, The Register).
· Sep 19 · observed · via fake recruiter · as waterplum, lazarus group · Threat Activity
- The Lazarus umbrella has been decomposed into six clusters. Kudelski Security and Sekoia map DPRK cyber capability onto TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet and Famous Chollima following a reorganization of the North Korean intelligence service two years ago, mixing espionage with crypto theft, ransomware and bank heists, and place each in the state structure (Kudelski Security).
· Sep 9 · none · as lazarus group, temp hermit, citrine sleet, cryptocore, jade sleet, moonstone sleet, famous chollima · Threat Activity
August 12, 2026
- Lazarus revived Operation Dream Job with a new Windows zero-day, delivering malicious PDFs via fake recruiters to exploit CVE-2026-68820 — the same afd.sys bug Microsoft patched this week — alongside CVE-2025-49113. Check Point traced a chain including a new in-memory backdoor, a kernel rootkit, and webshells against defense sectors in Europe and India (Check Point Research). Separately, ANY.RUN, BCA and NorthScan stood up a fake DeFi startup ("Blue Whale LTD") and knowingly hired suspected Famous Chollima operatives to observe DPRK IT-worker infiltration from the inside (ANY.RUN).
· Aug 12 · observed · via phishing email · as lazarus, famous chollima · Threat Activity
June 17, 2026
- Contagious Interview (Famous Chollima / North Korea) continues weaponizing developer recruitment and code-review themes to deliver malware through dev tools. The Hacker News.
· Jun 17 · observed · via fake recruiter · as famous chollima · Threat Activity