Contagious Interview
- ID
- G1052
- Associated names
- DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities. [1][2][3][4][5][6][7][8]
Techniques used (54)
- T1027.010 Command Obfuscation
- T1027.013 Encrypted/Encoded File
- T1036 Masquerading
- T1041 Exfiltration Over C2 Channel
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1059.003 Windows Command Shell
- T1059.004 Unix Shell
- T1059.005 Visual Basic
- T1059.006 Python
- T1059.007 JavaScript
- T1070.004 File Deletion
- T1071.003 Mail Protocols
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1090 Proxy
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1204.004 Malicious Copy and Paste
- T1204.005 Malicious Library
- T1219.002 Remote Desktop Software
- T1480 Execution Guardrails
- T1497 Virtualization/Sandbox Evasion
- T1543.001 Launch Agent
- T1546.004 Unix Shell Configuration Modification
- T1547.001 Registry Run Keys / Startup Folder
- T1547.013 XDG Autostart Entries
- T1555.001 Keychain
- T1566.003 Spearphishing via Service
- T1567 Exfiltration Over Web Service
- T1567.002 Exfiltration to Cloud Storage
- T1571 Non-Standard Port
- T1573.001 Symmetric Cryptography
- T1583 Acquire Infrastructure
- T1583.001 Domains
- T1583.003 Virtual Private Server
- T1583.006 Web Services
- T1585 Establish Accounts
- T1585.001 Social Media Accounts
- T1585.002 Email Accounts
- T1587 Develop Capabilities
- T1587.001 Malware
- T1588.002 Tool
- T1588.007 Artificial Intelligence
- T1589 Gather Victim Identity Information
- T1593 Search Open Websites/Domains
- T1593.001 Social Media
- T1593.003 Code Repositories
- T1608.001 Upload Malware
- T1657 Financial Theft
- T1681 Search Threat Vendor Data
- T1683.001 Written Content
- T1683.002 Audio-Visual Content
- T1684.001 Impersonation
- T1685 Disable or Modify Tools
Software used (4)
References
- Validin Contagious Interview North Korea ClickFix January 2025
- Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024
- Datadog Contagious Interview Tenacious Pungsan October 2024
- Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025
- ESET Contagious Interview BeaverTail InvisibleFerret February 2025
- Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024
- PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023
- PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024
