Contagious Interview

G105211 reports

aliases · Contagious Interview · DeceptiveDevelopment · Gwisin Gang · Tenacious Pungsan · DEV#POPPER · PurpleBravo · TAG-121

Reports

Techniques

Tactics

Countries

36%

Hunt coverage

Aliases

Analyst assessment — key judgments

Signature techniques: T1589.001 (Credentials), T1059.007 (JavaScript), T1684 (Social Engineering).
Primary targeting: US, KP, KR, CN.
Steady activity: 3 report(s) in last 30d vs 4 prior (-25%).
Recent movement: 8 new technique(s), 52 new infrastructure indicator(s) in the last 30 days.
Hunt coverage 36% of 44 observed techniques (28 gap(s)).
Assessment confidence: medium (61).

Activity & trend

SteadyLast 30d: 3 vs 4 prior (-25%)· first reported 2026-04-28 · last 2026-09-18

30d

90d

All

0.7

Rpts/wk

Reporting timeline · 12 months

Movement — last 30 days

New techniques

T1589.002T1593.003T1213.003T1546.016AML.T0095.000T1583.006T1584.006AML.T0072

Dropped (90d+)

T1195T1553.002T1552T1070.006T1059T1070T1098T1078T1195.002AML.T0012AML.T0050AML.T0055

Targeting gained

BRCAEGESIN

New infrastructure

4b2d3e8ccce8920a6d01e7d02b84236545a20e5f5728b11d30586bbfc1d8bd12df1c722a06e767a202df07a173ab03b82a4fb6a08973fff8b1467f28c491d477dbe0ae04e9aed9dbe237144c03f73ec44ad92bf92ee614b05c340ce17bef7b6ef5a25e82930e5be6d34511bedbfb0d762bd08fffe64e963019af09ebe8b7ad03419677dda515507dd099bc391cd6d13ff15adbf7a42025d10ec99b4ahttps://layerzero.network/publications/khttps://developer.hashicorp.com/terraforhttps://nostr.comhttps://redasgard.com/blog/hunting-lazar

Vulnerabilities in this actor's reporting · 9

Overview

Analyst triage

Intelligence summary

Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities. (Citation: Validin Contagious Interview North Korea ClickFix January 2025)(Citation: Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: Datadog Contagious Interview Tenacious Pungsan October 2024)(Citation: Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025)(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)(Citation: Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023)(Citation: PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024)

Top co-occurring indicators

Aliases & naming

Targeting · countries

Targeting · named victims

ATT&CK technique matrix

Coverage vs hunt library:

—

Hunt-coverage gaps — prioritized

Top techniques by observation

T1589.001 · Credentialsconf 756
evidence: Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurfac 7th September – Threat Intelligence Report New North Korean campaign uses fake coding interviews to steal develop
T1059.007 · JavaScriptconf 755
evidence: WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Ex Six npm Packages Use Ethereum Transactions to Retrieve Malicious Paylo Two Compromised joyfill npm Packages Run RAT When Imported Into Node.j
T1684 · Social Engineeringconf 703
evidence: Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurfac 6th July – Threat Intelligence Report Lazarus Doesn't Need AGI
T1588.006 · Vulnerabilitiesconf 602
evidence: 7th September – Threat Intelligence Report 6th July – Threat Intelligence Report
T1195 · Supply Chain Compromiseconf 652
evidence: CI/CD pipeline abuse: the problem no one is watching Lazarus Doesn't Need AGI
T1593.001 · Social Mediaconf 652
evidence: Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurfac PurpleDelta's Fraudulent Employment Operations
T1070.004 · File Deletionconf 601
evidence: 6th July – Threat Intelligence Report
T1176.001 · Browser Extensionsconf 601
evidence: New North Korean campaign uses fake coding interviews to steal develop
T1115 · Clipboard Dataconf 601
evidence: New North Korean campaign uses fake coding interviews to steal develop
T1082 · System Information Discoveryconf 601
evidence: New North Korean campaign uses fake coding interviews to steal develop
T1071 · Application Layer Protocolconf 601
evidence: New North Korean campaign uses fake coding interviews to steal develop
T1005 · Data from Local Systemconf 601
evidence: New North Korean campaign uses fake coding interviews to steal develop

Threat catalogue · engineering roadmap0

Flagged detection-engineering queue

Uncovered techniques you flagged for hunt / detection build-out, aggregated across every actor you visit. Stored locally in your browser.

Infrastructure

IOC type mix

Tooling / malware families

Relationships

Activity

30-day mention timeline

Recent reporting

Title	Source	Severity	Collected