# Japan Takes Down North Korean Laptop Farm Amid Global Cyber Campaign Revelation

*Published September 23, 2026*
*Source: [https://www.securityweek.com/japan-dismantles-first-north-korean-laptop-farm-as-us-and-allies-detail-wider-scheme/](https://www.securityweek.com/japan-dismantles-first-north-korean-laptop-farm-as-us-and-allies-detail-wider-scheme/)*

## Executive Summary

A joint advisory by Japan, the US, Australia, and Germany has exposed a North Korean cyber group, WaterPlum, which has been running a global scheme to steal cryptocurrency and infiltrate networks. Japan's dismantling of a North Korean laptop farm marks a key victory against this cyber threat.

## Article

In a significant cybersecurity operation, Japan, alongside the United States, Australia, and Germany, has dismantled a North Korean-run laptop farm as part of a wider investigation into the WaterPlum cyber campaign. This joint advisory has shed light on WaterPlum, also known as Contagious Interview, a North Korean group that has been posing as legitimate employers to target software developers and IT professionals worldwide. By impersonating real companies in sectors like AI, cryptocurrency, and NFTs, the group has successfully infiltrated networks and compromised thousands of devices.

Between late 2025 and mid-2026, WaterPlum managed to infect over 30,000 devices across more than 100 countries, primarily targeting professionals in web design, engineering, and blockchain technology. The group’s activities have resulted in the theft of funds or credentials from more than 7,000 cryptocurrency wallets, with an estimated $10.71 million funneling into North Korea. This operation is tied to the 313 General Bureau of the Munitions Industry Department under the Workers’ Party of Korea’s Central Committee.

The advisory highlights how laptop farms, often set up in accomplices' homes, are remotely operated by North Korean IT workers. These setups mask the workers' real locations while they perform paid IT tasks, effectively hiding their true intentions. Japan's recent dismantling of such a farm marks an important milestone in the fight against these cyber threats.

Beyond financial theft, the compromised systems provide WaterPlum with potential access to employers' networks, where they could exploit sensitive data for extortion or espionage. The advisory also describes case studies of attempted infiltrations, including one where a suspicious applicant was denied by a Japanese cryptocurrency exchange after several inconsistencies were noted during the hiring process. The use of AI face-swapping and other deceptive techniques emphasizes the group's sophisticated approach.

The FBI continues to track and prosecute facilitators within the US who aid North Korean IT workers, as part of ongoing efforts to curb these cyber threats.