CVE Intelligence
Home / Threat actors / Contagious Interview

Contagious Interview G1052

🔔 Create alert

Also known as: DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0
associated CVEs
59
Techniques
4
Malware and tools

Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Reconnaissance
T1589 Gather Victim Identity InformationT1593 Search Open Websites/DomainsT1593.001 Social MediaT1593.003 Code RepositoriesT1681 Search Threat Vendor Data
Resource Development
T1583 Acquire InfrastructureT1583.001 DomainsT1583.003 Virtual Private ServerT1583.006 Web ServicesT1585 Establish AccountsT1585.001 Social Media AccountsT1585.002 Email AccountsT1587 Develop CapabilitiesT1587.001 MalwareT1588.002 ToolT1588.007 Artificial IntelligenceT1608.001 Upload MalwareT1683.001 Written ContentT1683.002 Audio-Visual Content
Initial Access
T1566.003 Spearphishing via Service
Execution
T1059.003 Windows Command ShellT1059.004 Unix ShellT1059.005 Visual BasicT1059.006 PythonT1059.007 JavaScriptT1204.001 Malicious LinkT1204.002 Malicious FileT1204.004 Malicious Copy and PasteT1204.005 Malicious Library
Persistence
T1543.001 Launch AgentT1546.004 Unix Shell Configuration ModificationT1547.001 Registry Run Keys / Startup FolderT1547.013 XDG Autostart Entries
Privilege Escalation
T1543.001 Launch AgentT1546.004 Unix Shell Configuration ModificationT1547.001 Registry Run Keys / Startup FolderT1547.013 XDG Autostart Entries
Stealth
T1027.010 Command ObfuscationT1027.013 Encrypted/Encoded FileT1036 MasqueradingT1070.004 File DeletionT1480 Execution GuardrailsT1497 Virtualization/Sandbox EvasionT1684.001 Impersonation
Defense Impairment
T1685 Disable or Modify Tools
Credential Access
T1555.001 Keychain
Discovery
T1082 System Information DiscoveryT1083 File and Directory DiscoveryT1497 Virtualization/Sandbox Evasion
Command and Control
T1071.003 Mail ProtocolsT1090 ProxyT1219.002 Remote Desktop SoftwareT1571 Non-Standard PortT1573.001 Symmetric Cryptography
Exfiltration
T1041 Exfiltration Over C2 ChannelT1048.003 Exfiltration Over Unencrypted Non-C2 ProtocolT1567 Exfiltration Over Web ServiceT1567.002 Exfiltration to Cloud Storage
Impact
T1657 Financial Theft

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.