Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Contagious Interview · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06 · on the wire

Contagious Interview

  • DeceptiveDevelopment
  • Gwisin Gang
  • Tenacious Pungsan
  • DEV#POPPER
  • PurpleBravo
  • TAG-121

MITRE G1052 ↗

Contagious Interview — ATT&CK roseCI

attack rose · 54 techniques across 13 tactics

Last 30 days

last seen 25 d ago
dispatches5
victims0
CVEs seen0

What changed

ledger · newest first
  1. —28 d agoresurfacedback on the wire — nothing in the previous 30 days

Analyst brief

misp-galaxy + mitre-attack

Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

54 techniques · 13 of 15 tactics

  1. Reconnaissance

    5 techniques

  2. Resource development

    14 techniques

  3. Initial access

    1 technique

  4. Execution

    9 techniques

  5. Persistence

    3 techniques

  6. Privilege escalation

    1 technique

  7. Stealth

    7 techniques

  8. Defense impairment

    1 technique

  9. Credential access

    1 technique

  10. Discovery

    2 techniques

  11. Command and control

    5 techniques

  12. Exfiltration

    4 techniques

  13. Impact

    1 technique

select a technique

Arsenal

4 malware
Malware
Malware · 4ATT&CK
InvisibleFerretS1245 ↗
BeaverTailS1246 ↗
XORIndex LoaderS1248 ↗
HexEval LoaderS1249 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

On the wire

1 dispatch · newest first
  1. WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage

Take it with you

keyless · no signup

References

10 sources
  1. 1.about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-t…
  2. 2.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-in…
  3. 3.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-ma…
  4. 4.attack.mitre.org/groups/G1052
  5. 5.attack.mitre.org/groups/G1052
  6. 6.validin.com/blog/inoculating_contagious_interview_with_validin
  7. 7.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-laz…
  8. 8.securitylabs.datadoghq.com/articles/tenacious-pungsan-dprk-threat-actor-contagiou…
  9. 9.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat
  10. 10.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelanc…

Track Contagious Interview on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.