Threat actor
Contagious Interview
Tracked by CyberSIXT since 11 Oct 2025
- Articles · all time
- 11
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 11
12 articles from 1 outlet since 21 Jan; the latest 33 days ago.
- Article
- First report
- Research report
Show as table
Names and sources
- Contagious Interview
- Named by CyberSIXT coverage
- Contagious Interview
- Named by Malpedia · contagious_interview
- Contagious Interview
- Named by MISP Galaxy · b2765bd8-1200-4df5-a9d3-72a7b679dcdb
- Contagious Interview
- Named by MITRE ATT&CK® · G1052
- DeceptiveDevelopment
- Named by MITRE ATT&CK® · G1052
- Gwisin Gang
- Named by MITRE ATT&CK® · G1052
- PurpleBravo
- Named by MITRE ATT&CK® · G1052
- TAG-121
- Named by MITRE ATT&CK® · G1052
All 11 names
- Tenacious Pungsan
- Named by MITRE ATT&CK® · G1052
- Contagious Interview APT
- Named by CyberSIXT coverage
- G1052
- Named by MITRE ATT&CK®
Malware and tools
MITRE ATT&CK® techniques
From MITRE ATT&CK® · G1052
Execution
Stealth
Command and Control
- T1071.003
- Mail Protocols
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- North Korean Recruiters Target Developers With Malware in InterviewsSecurityOnline
- North Korean Hackers Infected 30,000 Devices Through Fake JobsInfosecurity
- North Korean Fake Jobs Infected 30,000 Devices and Stole $10.7mSecurityWeek
- Fake macOS Installers Hide OtterCookie Backdoor in North Korean CampaignSecurityOnline
- New North Korean campaign uses fake coding interviews to steal developer credentialselastic.co
- North Korean hackers use fake coding tests to spread OtterCookieThe Hacker News
- North Korea-Linked PolinRider Supply Chain Attack Expands Across Open SourceSecurityOnline
- North Korean Hackers Drop 108 Malicious PolinRider PackagesThe Hacker News
- North Korean hackers weaponise developer tools to spread malwareThe Hacker News
- North Korean Hackers Use Supply Chain npm SDK to Steal SecretsThe Hacker News
- $285 Million Drift Hack Traced to Six-Month DPRK Social Engineering OperationThe Hacker News
- North Korean PurpleBravo Campaign Targeted 3,136 IP Addresses via Fake Job InterviewsThe Hacker News
The latest 12 are listed. See all 17 articles in the timeline.
Research reports
- Contagious Interview steps outside the developer workflowOrkl.eu · 25 Sep
- From fake interviews to malicious repositories: Disrupting Contagious InterviewOrkl.eu · 25 Sep
- North Korea Is HiringOrkl.eu · 8 Sep
- Six npm Packages Use Ethereum Transactions to Retrieve Malicious PayloadsOrkl.eu · 14 Aug
- New North Korean campaign uses fake coding interviews to steal developer credentialsOrkl.eu · 21 Jul
- eset-apt-activity-report-q4-2025-q1-2026.pdfOrkl.eu · 20 Jun
- eset-apt-activity-report-q2-2025-q3-2025.pdfOrkl.eu · 20 Jun
- Hunting Lazarus Part VII: The Server That Was Not Just FTPOrkl.eu · 12 May
- Lazarus Group Uses Git Hooks To Hide MalwareOrkl.eu · 7 May
- DeceptiveDevelopment-and-North-Korean-IT-workers-from-primitive-crypto-theft-to-sophisticated-AI-based-deception.pdfOrkl.eu · 16 Oct 2025