Threat intelligence / Group

Contagious Interview

[Contagious Interview](https://attack.mitre.org/groups/G1052) is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. [Contagious Interview](https://attack.mitre.org/groups/G1052) targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities. (Citation: Validin Contagious Interview North Korea ClickFix January 2025)(Citation: Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: Datadog Contagious Interview Tenacious Pungsan October 2024)(Citation: Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025)(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)(Citation: Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023)(Citation: PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

58 recorded

Relationships

uses

to Acquire Infrastructure

Technique

uses

to Artificial Intelligence

Technique

uses

to Audio-Visual Content

Technique

uses

to BeaverTail

Malware

uses

to Code Repositories

Technique

uses

to Command Obfuscation

Technique

uses

to Develop Capabilities

Technique

uses

to Disable or Modify Tools

Technique

uses

to Domains

Technique

uses

to Email Accounts

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Establish Accounts

Technique

uses

to Execution Guardrails

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exfiltration Over Unencrypted Non-C2 Protocol

Technique

uses

to Exfiltration Over Web Service

Technique

uses

to Exfiltration to Cloud Storage

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Financial Theft

Technique

uses

to Gather Victim Identity Information

Technique

uses

to HexEval Loader

Malware

uses

to Impersonation

Technique

uses

to InvisibleFerret

Malware

uses

to JavaScript

Technique

uses

to Keychain

Technique

uses

to Launch Agent

Technique

uses

to Mail Protocols

Technique

uses

to Malicious Copy and Paste

Technique

uses

to Malicious File

Technique

uses

to Malicious Library

Technique

uses

to Malicious Link

Technique

uses

to Malware

Technique

uses

to Masquerading

Technique

uses

to Non-Standard Port

Technique

uses

to Proxy

Technique

uses

to Python

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Remote Desktop Software

Technique

uses

to Search Open Websites/Domains

Technique

uses

to Search Threat Vendor Data

Technique

uses

to Social Media

Technique

uses

to Social Media Accounts

Technique

uses

to Spearphishing via Service

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to Tool

Technique

uses

to Unix Shell

Technique

uses

to Unix Shell Configuration Modification

Technique

uses

to Upload Malware

Technique

uses

to Virtualization/Sandbox Evasion

Technique

uses

to Virtual Private Server

Technique

uses

to Visual Basic

Technique

uses

to Web Services

Technique

uses

to Windows Command Shell

Technique

uses

to Written Content

Technique

uses

to XDG Autostart Entries

Technique

uses

to XORIndex Loader

Malware

18 external

References

mitre-attack

G1052

open

Tenacious Pungsan

—

DeceptiveDevelopment

—

PurpleBravo

—

TAG-121

—

DEV#POPPER

—

Gwisin Gang

—

Sentinel One Contagious Interview ClickFix September 2025

https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/

open

Validin Contagious Interview North Korea ClickFix January 2025

https://www.validin.com/blog/inoculating_contagious_interview_with_validin/

open

Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024

https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2

open

Datadog Contagious Interview Tenacious Pungsan October 2024

https://securitylabs.datadoghq.com/articles/tenacious-pungsan-dprk-threat-actor-contagious-interview/

open

Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025

https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat

open

ESET Contagious Interview BeaverTail InvisibleFerret February 2025

https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/

open

dtex DPRK 2025 structure ITworkers

https://reports.dtexsystems.com/DTEX-Exposing+DPRK+Cyber+Syndicate+and+Hidden+IT+Workforce.pdf

open

Securonix Contagious Interview DEVPOPPER April 2024

https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/

open

Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024

https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west

open

PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023

https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/

open

PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024

https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/

open