Contagious Interview

Also known as: DeceptiveDevelopment · Gwisin Gang · Tenacious Pungsan · DEV#POPPER · PurpleBravo · TAG-121

Overview

Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities.

Naming & attribution

Contagious Interview is tracked under 7 names across the industry. It uses 54 documented ATT&CK techniques — more than 86% of the 174 groups tracked here. Activity attributed since 2023.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
DeceptiveDevelopment	Matej Havranek
Gwisin Gang	Aleksandar Milenkoski, Sreekar Madabushi, Kenneth Kinion
Tenacious Pungsan	Ian Kretz, Sebastian Obregoso, Datadog Security Research Team
DEV#POPPER	Securonix Threat Research, D.Iuzvyk, T. Peck, O.Kolesnikov
PurpleBravo	Insikt Group
TAG-121	Insikt Group

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

T1204.005 Malicious Library — used by 1 of 174 groups
T1543.001 Launch Agent — used by 1 of 174 groups
T1546.004 Unix Shell Configuration Modification — used by 1 of 174 groups
T1547.013 XDG Autostart Entries — used by 1 of 174 groups
T1555.001 Keychain — used by 1 of 174 groups
T1588.007 Artificial Intelligence — used by 2 of 174 groups
T1681 Search Threat Vendor Data — used by 2 of 174 groups
T1683.001 Written Content — used by 2 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

APT-C-36 — 17 shared techniques (23% overlap)
MuddyWater Iran — 22 shared techniques (22% overlap)
Kimsuky North Korea — 31 shared techniques (20% overlap)
APT32 Vietnam — 22 shared techniques (20% overlap)
Magic Hound Iran — 21 shared techniques (19% overlap)
Mustang Panda China — 21 shared techniques (18% overlap)

Malware families with current indicators

2 families attributed to Contagious Interview, carrying 47 indicators currently tracked from abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL. MITRE documents what a group does; this is what its tooling is doing now.

BeaverTail 30 indicators
InvisibleFerret 17 indicators

Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.

Capabilities

Custom malware/implant development — ATT&CK: 4 attributed custom malware families

TTPs — 54 techniques across 13 tactics

Stealth

Defense Impairment

T1685 Disable or Modify Tools

Credential Access

T1555.001 Keychain

Discovery

T1082 System Information Discovery
T1083 File and Directory Discovery

Command and Control

T1071.003 Mail Protocols
T1090 Proxy
T1219.002 Remote Desktop Software
T1571 Non-Standard Port
T1573.001 Symmetric Cryptography

Exfiltration

T1041 Exfiltration Over C2 Channel
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
T1567 Exfiltration Over Web Service
T1567.002 Exfiltration to Cloud Storage

Impact

T1657 Financial Theft

Tools & malware (4)

InvisibleFerret · BeaverTail · XORIndex Loader · HexEval Loader

Reporting (3)

Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms — Aleksandar Milenkoski, Sreekar Madabushi, Kenneth Kinion
Exposing DPRK's Cyber Syndicate and Hidden IT Workforce — Michael “Barni” Barnhart, DTEX, and Anonymous SMEs
DeceptiveDevelopment targets freelance developers — Matej Havranek