Contagious Interview
threat actor01
also known as
Other names and identifiers for this entity.
ATT&CK
Contagious Interview · DEV#POPPER · DeceptiveDevelopment · Gwisin Gang · PurpleBravo · TAG-121 · Tenacious Pungsan
MISP
Contagious Interview
Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities.
02
resolved ATT&CK groups
Threat groups associated with this.
03
techniques used (54)
ATT&CK techniques this enables or maps to.
showing 20 of 54
04
software used (4)
Malware and tools associated with this.
05
references
External citations — patches, advisories, analysis.
- https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/
- https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/
- https://www.microsoft.com/en-us/security/blog/2026/03/11/contagious-interview-malware-delivered-through-fake-developer-job-interviews/
- https://attack.mitre.org/groups/G1052/