type: intrusion-set
spec_version: 2.1
id: intrusion-set--46599a4a-77ee-4697-9474-2683b6464859
created: 2025-10-19T17:04:30.994Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1052
external_id: G1052
source_name: Tenacious Pungsan
description: (Citation: Datadog Contagious Interview Tenacious Pungsan October 2024)
source_name: DeceptiveDevelopment
description: (Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)
source_name: PurpleBravo
description: (Citation: Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025)
source_name: TAG-121
description: (Citation: Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025)
source_name: DEV#POPPER
description: (Citation: Securonix Contagious Interview DEVPOPPER April 2024)
source_name: Gwisin Gang
description: (Citation: Sentinel One Contagious Interview ClickFix September 2025)(Citation: dtex DPRK 2025 structure ITworkers)
source_name: Sentinel One Contagious Interview ClickFix September 2025
description: Aleksandar Milenkoski, Sreekar Madabushi, Kenneth Kinion. (2025, September 4). Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms. Retrieved October 20, 2025.
url: https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/
source_name: Validin Contagious Interview North Korea ClickFix January 2025
description: Efstratios Lontzetidis. (2025, January 16). Lazarus APT: Techniques for Hunting Contagious Interview. Retrieved October 20, 2025.
url: https://www.validin.com/blog/inoculating_contagious_interview_with_validin/
source_name: Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024
description: eSentire Threat Response Unit (TRU). (2024, November 14). Bored BeaverTail & InvisibleFerret Yacht Club – A Lazarus Lure Pt.2. Retrieved October 17, 2025.
url: https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2
source_name: Datadog Contagious Interview Tenacious Pungsan October 2024
description: Ian Kretz, Sebastian Obregoso, Datadog Security Research Team. (2024, October 24). Tenacious Pungsan: A DPRK threat actor linked to Contagious Interview. Retrieved October 20, 2025.
url: https://securitylabs.datadoghq.com/articles/tenacious-pungsan-dprk-threat-actor-contagious-interview/
source_name: Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025
description: Insikt Group. (2025, February 13). Inside the Scam: North Korea’s IT Worker Threat. Retrieved October 17, 2025.
url: https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat
source_name: ESET Contagious Interview BeaverTail InvisibleFerret February 2025
description: Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.
url: https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/
source_name: dtex DPRK 2025 structure ITworkers
description: Michael “Barni” Barnhart, DTEX, and Anonymous SMEs. (2025, May 14). Exposing DPRK's Cyber Syndicate and Hidden IT Workforce. Retrieved September 3, 2025.
url: https://reports.dtexsystems.com/DTEX-Exposing+DPRK+Cyber+Syndicate+and+Hidden+IT+Workforce.pdf
source_name: Securonix Contagious Interview DEVPOPPER April 2024
description: Securonix Threat Research, D.Iuzvyk, T. Peck, O.Kolesnikov. (2024, April 24). Analysis of DEV#POPPER: New Attack Campaign Targeting Software Developers Likely Associated With North Korean Threat Actors. Retrieved October 20, 2025.
url: https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/
source_name: Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024
description: Seongsu Park. (2024, November 4). From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West. Retrieved October 17, 2025.
url: https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west
source_name: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023
description: Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025.
url: https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/
source_name: PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024
description: Unit42. (2024, October 9). Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware. Retrieved October 17, 2025.
url: https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T02:54:55.039Z
name: Contagious Interview
description: [Contagious Interview](https://attack.mitre.org/groups/G1052) is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. [Contagious Interview](https://attack.mitre.org/groups/G1052) targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities. (Citation: Validin Contagious Interview North Korea ClickFix January 2025)(Citation: Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: Datadog Contagious Interview Tenacious Pungsan October 2024)(Citation: Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025)(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)(Citation: Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023)(Citation: PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024)
aliases: Contagious Interview
DeceptiveDevelopment
Gwisin Gang
Tenacious Pungsan
DEV#POPPER
PurpleBravo
TAG-121
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_domains: enterprise-attack