coldbraid

Contagious Interview

Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities.

ATT&CK ID
G1052
Techniques
34
Tools
4

Also tracked as DeceptiveDevelopment · Gwisin Gang · Tenacious Pungsan · DEV#POPPER · PurpleBravo · TAG-121

Techniques

Reconnaissance

Gather Victim Identity InformationSearch Open Websites/DomainsSearch Threat Vendor Data

Resource Development

Acquire InfrastructureEstablish AccountsDevelop CapabilitiesObtain CapabilitiesStage CapabilitiesGenerate Content

Initial Access

Phishing

Execution

Command and Scripting InterpreterUser Execution

Persistence

Create or Modify System ProcessEvent Triggered ExecutionBoot or Logon Autostart Execution

Privilege Escalation

Create or Modify System ProcessEvent Triggered ExecutionBoot or Logon Autostart Execution

Stealth

Obfuscated Files or InformationMasqueradingIndicator RemovalExecution GuardrailsVirtualization/Sandbox EvasionSocial Engineering

Defense Impairment

Disable or Modify Tools

Credential Access

Credentials from Password Stores

Discovery

System Information DiscoveryFile and Directory DiscoveryVirtualization/Sandbox Evasion

Command and Control

Application Layer ProtocolProxyRemote Access ToolsNon-Standard PortEncrypted Channel

Exfiltration

Exfiltration Over C2 ChannelExfiltration Over Alternative ProtocolExfiltration Over Web Service

Impact

Financial Theft

Software

BeaverTail · HexEval Loader · InvisibleFerret · XORIndex Loader

MITRE ATT&CKAll threat actors