Automation · API / MCP 中文

Group profile · G1052

Contagious Interview

Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities.

ATT&CK G1052 Confidence High · 100 Source src_mitre_attck_enterprise Status active
All2025

Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities. 12345678

  1. Validin Contagious Interview North Korea ClickFix January 2025
  2. Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024
  3. Datadog Contagious Interview Tenacious Pungsan October 2024
  4. Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025
  5. ESET Contagious Interview BeaverTail InvisibleFerret February 2025
  6. Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024
  7. PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023
  8. PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024

Claims and citations

Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.

predicateobjectValidConf.Evidence
also_known_asContagious Interview— → …100src_mitre_attck_enterprise
also_known_asDeceptiveDevelopment— → …100src_mitre_attck_enterprise
also_known_asGwisin Gang— → …100src_mitre_attck_enterprise
also_known_asTenacious Pungsan— → …100src_mitre_attck_enterprise
also_known_asDEV#POPPER— → …100src_mitre_attck_enterprise
also_known_asPurpleBravo— → …100src_mitre_attck_enterprise
also_known_asTAG-121— → …100src_mitre_attck_enterprise
uses_techniquetech_t1555.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t15852025 → …100src_mitre_attck_enterprise
uses_techniquetech_t10832025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0062025 → …100src_mitre_attck_enterprise
uses_techniquetech_t15712025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0052025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1219.0022025 → …100src_mitre_attck_enterprise
uses_techniquetech_t10362025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0022025 → …100src_mitre_attck_enterprise
uses_techniquetech_t14972025 → …100src_mitre_attck_enterprise
uses_techniquetech_t15672025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0042025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1587.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1593.0032025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1566.0032025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1546.0042025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1683.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t16852025 → …100src_mitre_attck_enterprise
uses_techniquetech_t16812025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0032025 → …100src_mitre_attck_enterprise
uses_techniquetech_t16572025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1048.0032025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0072025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1547.0132025 → …100src_mitre_attck_enterprise
uses_techniquetech_t15872025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1070.0042025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0022025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1543.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t10412025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1593.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t15832025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0132025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1567.0022025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1684.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0042025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0062025 → …100src_mitre_attck_enterprise
uses_techniquetech_t15892025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0032025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0072025 → …100src_mitre_attck_enterprise
uses_techniquetech_t10902025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1573.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1071.0032025 → …100src_mitre_attck_enterprise
uses_techniquetech_t10822025 → …100src_mitre_attck_enterprise
uses_techniquetech_t15932025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0102025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1608.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0052025 → …100src_mitre_attck_enterprise
uses_techniquetech_t14802025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1585.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1547.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1585.0022025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1683.0022025 → …100src_mitre_attck_enterprise

Technique use

ATT&CKTechniqueplatforms
T1027.010Command Obfuscation—
T1027.013Encrypted/Encoded File—
T1036Masquerading—
T1041Exfiltration Over C2 Channel—
T1048.003Exfiltration Over Unencrypted Non-C2 Protocol—
T1059.003Windows Command Shell—
T1059.004Unix Shell—
T1059.005Visual Basic—
T1059.006Python—
T1059.007JavaScript—
T1070.004File Deletion—
T1071.003Mail Protocols—
T1082System Information Discovery—
T1083File and Directory Discovery—
T1090Proxy—
T1204.001Malicious Link—
T1204.002Malicious File—
T1204.004Malicious Copy and Paste—
T1204.005Malicious Library—
T1219.002Remote Desktop Software—
T1480Execution Guardrails—
T1497Virtualization/Sandbox Evasion—
T1543.001Launch Agent—
T1546.004Unix Shell Configuration Modification—
T1547.001Registry Run Keys / Startup Folder—
T1547.013XDG Autostart Entries—
T1555.001Keychain—
T1566.003Spearphishing via Service—
T1567Exfiltration Over Web Service—
T1567.002Exfiltration to Cloud Storage—
T1571Non-Standard Port—
T1573.001Symmetric Cryptography—
T1583Acquire Infrastructure—
T1583.001Domains—
T1583.003Virtual Private Server—
T1583.006Web Services—
T1585Establish Accounts—
T1585.001Social Media Accounts—
T1585.002Email Accounts—
T1587Develop Capabilities—
T1587.001Malware—
T1588.002Tool—
T1588.007Artificial Intelligence—
T1589Gather Victim Identity Information—
T1593Search Open Websites/Domains—
T1593.001Social Media—
T1593.003Code Repositories—
T1608.001Upload Malware—
T1657Financial Theft—
T1681Search Threat Vendor Data—
T1683.001Written Content—
T1683.002Audio-Visual Content—
T1684.001Impersonation—
T1685Disable or Modify Tools—

Aliases

Contagious Interview · DeceptiveDevelopment · DEV#POPPER · Gwisin Gang · PurpleBravo · TAG-121 · Tenacious Pungsan

Reading and review

Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.

Corrections