Início / Grupos de ameaça / Contagious Interview

Contagious Interview G1052

🔔 Criar alerta

Também conhecido como: DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

0

CVEs associadas

59

Técnicas

4

Malwares e ferramentas

Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

O ATT&CK não cita CVEs para este grupo.

Técnicas por tática

Reconhecimento

T1589 Gather Victim Identity Information T1593 Search Open Websites/Domains T1593.001 Social Media T1593.003 Code Repositories T1681 Search Threat Vendor Data

Desenvolvimento de recursos

T1583 Acquire Infrastructure T1583.001 Domains T1583.003 Virtual Private Server T1583.006 Web Services T1585 Establish Accounts T1585.001 Social Media Accounts T1585.002 Email Accounts T1587 Develop Capabilities T1587.001 Malware T1588.002 Tool T1588.007 Artificial Intelligence T1608.001 Upload Malware T1683.001 Written Content T1683.002 Audio-Visual Content

Acesso inicial

T1566.003 Spearphishing via Service

Execução

T1059.003 Windows Command Shell T1059.004 Unix Shell T1059.005 Visual Basic T1059.006 Python T1059.007 JavaScript T1204.001 Malicious Link T1204.002 Malicious File T1204.004 Malicious Copy and Paste T1204.005 Malicious Library

Persistência

T1543.001 Launch Agent T1546.004 Unix Shell Configuration Modification T1547.001 Registry Run Keys / Startup Folder T1547.013 XDG Autostart Entries

Escalada de privilégios

T1543.001 Launch Agent T1546.004 Unix Shell Configuration Modification T1547.001 Registry Run Keys / Startup Folder T1547.013 XDG Autostart Entries

Furtividade

T1027.010 Command Obfuscation T1027.013 Encrypted/Encoded File T1036 Masquerading T1070.004 File Deletion T1480 Execution Guardrails T1497 Virtualization/Sandbox Evasion T1684.001 Impersonation

Comprometimento de defesas

T1685 Disable or Modify Tools

Acesso a credenciais

T1555.001 Keychain

Descoberta

T1082 System Information Discovery T1083 File and Directory Discovery T1497 Virtualization/Sandbox Evasion

Comando e controle

T1071.003 Mail Protocols T1090 Proxy T1219.002 Remote Desktop Software T1571 Non-Standard Port T1573.001 Symmetric Cryptography

Exfiltração

T1041 Exfiltration Over C2 Channel T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol T1567 Exfiltration Over Web Service T1567.002 Exfiltration to Cloud Storage

Impacto

T1657 Financial Theft

Malwares e ferramentas

BeaverTailMalwareS1246
HexEval LoaderMalwareS1249
InvisibleFerretMalwareS1245
XORIndex LoaderMalwareS1248

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.