WaterPlum hackers compromise 30,000 devices worldwide

A joint law enforcement advisory reveals that the North Korean threat group WaterPlum infected at least 30,000 devices globally between December 2025 and July 2026. The attackers successfully transferred over $10.7 million in stolen cryptocurrency back to North Korea. Security administrators should review threat intelligence feeds for indicators of compromise associated with this ongoing campaign.