North Korea’s WaterPlum APT Deploys Node.js OtterCandy RAT for Crypto Theft with Anti-Forensic Module

North Korea’s WaterPlum APT has evolved its OtterCandy malware, built with Node.js to function as both a Remote Access Trojan and an Information Stealer across Windows, macOS and Linux. According to NTT Security Japan, OtterCandy can steal browser credentials, cryptocurrency wallets and other confidential files, with the latest update in August 2025 refining persistence and data-theft capabilities and introducing an anti-forensic module that removes traces after execution.

The campaign, observed targeting Japan, traces its activity to Cluster B of WaterPlum, a group also linked to earlier tools such as BeaverTail, GolangGhost and FrostyFerret, and marks a cross-platform expansion of the malware’s capabilities.

The first OtterCandy sample uploaded to VirusTotal appeared in February 2025, and researchers note it was identical to a sample previously mislabelled as OtterCookie in Silent Push’s report, with v2 adding client_id and expanding the range of browser extensions from four to seven. Overall, OtterCandy v2 introduces three major updates, enhancing both exfiltration scope and the anti-forensic features.