Japan’s National Police Agency and the FBI reported that the group operated from December 2025 to July 2026 across more than 100 countries and regions. WaterPlum impersonated recruiters from crypto, AI, and NFT firms to trick job seekers into running malware. Japanese police also dismantled their first identified domestic laptop farm supporting North Korean IT workers.