North Korean PurpleBravo Campaign Targeted 3,136 IP Addresses via Fake Job Interviews

According to Recorded Future, Insikt Group, PurpleBravo—a North Korean threat activity cluster—targeted 3,136 individual IP addresses, primarily concentrated around South Asia and North America, and is suspected of hitting 20 victim organisations across AI, cryptocurrency, financial services, IT services, marketing, and software development sectors in Europe, South Asia, the Middle East, and Central America.

The campaign, first documented in late 2023 and also known as CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang, Tenacious Pungsan, UNC5342, Void Dokkaebi and WaterPlum, has been active from August 2024 to September 2025. It is paired with the Contagious Interview campaign, and a separate cluster called Wagemole (aka PurpleDelta), with overlaps in tactics and infrastructure, including the use of Astrill VPN and suspect C2 activity.

Mastercard reported four LinkedIn personas masquerading as developers and recruiters from Odesa, linked to the PurpleBravo activity, alongside GitHub repositories designed to deliver malware families like BeaverTail. The group has been observed managing two C2 sets for BeaverTail and a Go-based backdoor known as GolangGhost, and it has used compromised candidate devices during coding assessments to widen organizational exposure.