- Category
- State · Attributed to a state or working for one.
- Origin
- North Korea(high confidence)
- Agency named
- Lazarus
- Motivation
- Information theft and espionage
- Seen
- 2019–2026
- Status
- Active
- ATT&CK
- G1052 · 54 techniques
- Sources
- 10 sources carry it
- Identifier
- GINC-APT-0059 · contagious-interview
North KoreaWhat it is
Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Famous Chollima
- Mandiant
- UNC5267
- Microsoft
- Coral Sleet, Jasper Sleet, Storm-0287, Storm-1877
- Recorded Future
- TAG-121
- Operations
- Operation Contagious Interview, Operation “DEV#POPPER”
- Other names
- [Unnamed groups: North Korea], WageMole, DeceptiveDevelopment, DEV#POPPER, Gwisin Gang, Nickel Tapestry, PurpleBravo, Tenacious Pungsan, Void Dokkaebi, WaterPlum
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTNorth Korea
- MISP Galaxy (CFR tagging)North Korea
- MicrosoftNorth Korea
- ThreatActor.info (Malpedia et al.)North Korea
Tools
The tools and malware families the sources tie to it.
- BeaverTail
- Cyber Eye RAT
- CyberGate
- HexEval Loader
- InvisibleFerret
- Remote Utilities
- RemoteCMD
- RemotePC
- Small-Net
- Windows Remote Desktop
- XORIndex Loader
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de