WaterPlum

☆ pin

MITRE G0170Also known as PurpleBravo, UNC5342, CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Gwisin Gang, Tenacious Pungsan

Reports

First seen

Sep 18, 2026

Last seen

Sep 22, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Technology ×1

Top ATT&CK techniques

T1566 Phishing ×4T1041 Exfiltration Over C2 Channel ×3T1005 Data from Local System ×3T1555 Credentials from Password Stores ×3T1219 Remote Access Software ×3T1204 User Execution ×2T1204.001 User Execution: Malicious Link ×1T1040 Network Sniffing ×1T1570 Lateral Tool Transfer ×1T1105 Ingress Tool Transfer ×1T1589 Gather Victim Identity Information ×1T1078 Valid Accounts ×1

Indicators

cve ×4filename ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-76460 (exploited)CVE-2026-76461 CVE-2026-77692 CVE-2026-91843

Recent reports

High

WaterPlum

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Check Point Threat Intelligence Report – 21 September 2026

Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto

North Korean WaterPlum group infected 30,000 devices, stole $10.7M in cryptocurrency

International security agencies warn about North Korean hackers exploiting job seekers to steal crypto and data

North Korean WaterPlum campaign infects 30,000+ devices, steals $10.5M from job seekers