自动化接入 · API / MCP EN

组织档案 · G1052

Contagious Interview

Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities.

ATT&CK G1052 置信带 高 · 100 来源 src_mitre_attck_enterprise 状态 active
全部2025

Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities. 12345678

  1. Validin Contagious Interview North Korea ClickFix January 2025
  2. Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024
  3. Datadog Contagious Interview Tenacious Pungsan October 2024
  4. Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025
  5. ESET Contagious Interview BeaverTail InvisibleFerret February 2025
  6. Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024
  7. PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023
  8. PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024

断言与引用

每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。

predicateobject有效期置信证据
also_known_asContagious Interview— → …100src_mitre_attck_enterprise
also_known_asDeceptiveDevelopment— → …100src_mitre_attck_enterprise
also_known_asGwisin Gang— → …100src_mitre_attck_enterprise
also_known_asTenacious Pungsan— → …100src_mitre_attck_enterprise
also_known_asDEV#POPPER— → …100src_mitre_attck_enterprise
also_known_asPurpleBravo— → …100src_mitre_attck_enterprise
also_known_asTAG-121— → …100src_mitre_attck_enterprise
uses_techniquetech_t1555.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t15852025 → …100src_mitre_attck_enterprise
uses_techniquetech_t10832025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0062025 → …100src_mitre_attck_enterprise
uses_techniquetech_t15712025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0052025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1219.0022025 → …100src_mitre_attck_enterprise
uses_techniquetech_t10362025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0022025 → …100src_mitre_attck_enterprise
uses_techniquetech_t14972025 → …100src_mitre_attck_enterprise
uses_techniquetech_t15672025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0042025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1587.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1593.0032025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1566.0032025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1546.0042025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1683.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t16852025 → …100src_mitre_attck_enterprise
uses_techniquetech_t16812025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0032025 → …100src_mitre_attck_enterprise
uses_techniquetech_t16572025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1048.0032025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0072025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1547.0132025 → …100src_mitre_attck_enterprise
uses_techniquetech_t15872025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1070.0042025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0022025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1543.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t10412025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1593.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t15832025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0132025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1567.0022025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1684.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0042025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0062025 → …100src_mitre_attck_enterprise
uses_techniquetech_t15892025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1583.0032025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0072025 → …100src_mitre_attck_enterprise
uses_techniquetech_t10902025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1573.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1071.0032025 → …100src_mitre_attck_enterprise
uses_techniquetech_t10822025 → …100src_mitre_attck_enterprise
uses_techniquetech_t15932025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0102025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1608.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0052025 → …100src_mitre_attck_enterprise
uses_techniquetech_t14802025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1585.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1547.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1585.0022025 → …100src_mitre_attck_enterprise
uses_techniquetech_t1683.0022025 → …100src_mitre_attck_enterprise

技术使用

ATT&CK技术platforms
T1027.010Command Obfuscation—
T1027.013Encrypted/Encoded File—
T1036Masquerading—
T1041Exfiltration Over C2 Channel—
T1048.003Exfiltration Over Unencrypted Non-C2 Protocol—
T1059.003Windows Command Shell—
T1059.004Unix Shell—
T1059.005Visual Basic—
T1059.006Python—
T1059.007JavaScript—
T1070.004File Deletion—
T1071.003Mail Protocols—
T1082System Information Discovery—
T1083File and Directory Discovery—
T1090Proxy—
T1204.001Malicious Link—
T1204.002Malicious File—
T1204.004Malicious Copy and Paste—
T1204.005Malicious Library—
T1219.002Remote Desktop Software—
T1480Execution Guardrails—
T1497Virtualization/Sandbox Evasion—
T1543.001Launch Agent—
T1546.004Unix Shell Configuration Modification—
T1547.001Registry Run Keys / Startup Folder—
T1547.013XDG Autostart Entries—
T1555.001Keychain—
T1566.003Spearphishing via Service—
T1567Exfiltration Over Web Service—
T1567.002Exfiltration to Cloud Storage—
T1571Non-Standard Port—
T1573.001Symmetric Cryptography—
T1583Acquire Infrastructure—
T1583.001Domains—
T1583.003Virtual Private Server—
T1583.006Web Services—
T1585Establish Accounts—
T1585.001Social Media Accounts—
T1585.002Email Accounts—
T1587Develop Capabilities—
T1587.001Malware—
T1588.002Tool—
T1588.007Artificial Intelligence—
T1589Gather Victim Identity Information—
T1593Search Open Websites/Domains—
T1593.001Social Media—
T1593.003Code Repositories—
T1608.001Upload Malware—
T1657Financial Theft—
T1681Search Threat Vendor Data—
T1683.001Written Content—
T1683.002Audio-Visual Content—
T1684.001Impersonation—
T1685Disable or Modify Tools—

别名

Contagious Interview · DeceptiveDevelopment · DEV#POPPER · Gwisin Gang · PurpleBravo · TAG-121 · Tenacious Pungsan

读取与复核

记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。

纠错