North Korean Hacking Group WaterPlum Compromises 30,000 Devices Worldwide, Transfers $10.7 Million in Cryptocurrency

According to a joint law enforcement advisory published by BleepingComputer on September 19, 2026, the North Korean hacking group WaterPlum conducted a global campaign compromising a minimum of 30,000 devices. The activity tracked occurred between December 2025 and July 2026. The advisory, issued by international law enforcement bodies, details that the threat actors exfiltrated cryptocurrency from compromised systems and transferred more than $10.7 million in stolen funds to North Korea. The group WaterPlum is also tracked under the aliases APT37 and Reaper. The advisory does not detail specific initial access vectors or exploitation methods in the summary, but emphasizes the scale of the compromise and the financial impact. The advisory serves as a warning to organizations worldwide to review security postures and apply recommended mitigations. No specific software vulnerabilities or patches were identified in the initial reporting; general guidance focuses on applying security updates and adhering to the advisory's technical recommendations.