Contagious Interview

{
  "id": "ATTACK:enterprise:G1052",
  "title": "Contagious Interview",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G1052",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--46599a4a-77ee-4697-9474-2683b6464859",
  "external_id": "G1052",
  "domain": "enterprise",
  "created": "2025-10-19T17:04:30.994Z",
  "modified": "2026-07-31T18:47:53.854Z",
  "version": "1.0",
  "aliases": [
    "Contagious Interview",
    "DeceptiveDevelopment",
    "Gwisin Gang",
    "Tenacious Pungsan",
    "DEV#POPPER",
    "PurpleBravo",
    "TAG-121"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Tenacious Pungsan"
    },
    {
      "source_name": "DeceptiveDevelopment"
    },
    {
      "source_name": "PurpleBravo"
    },
    {
      "source_name": "TAG-121"
    },
    {
      "source_name": "DEV#POPPER"
    },
    {
      "source_name": "Gwisin Gang"
    },
    {
      "source_name": "Sentinel One Contagious Interview ClickFix September 2025",
      "url": "https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/"
    },
    {
      "source_name": "Validin Contagious Interview North Korea ClickFix January 2025",
      "url": "https://www.validin.com/blog/inoculating_contagious_interview_with_validin/"
    },
    {
      "source_name": "Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024",
      "url": "https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"
    },
    {
      "source_name": "Datadog Contagious Interview Tenacious Pungsan October 2024",
      "url": "https://securitylabs.datadoghq.com/articles/tenacious-pungsan-dprk-threat-actor-contagious-interview/"
    },
    {
      "source_name": "Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025",
      "url": "https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"
    },
    {
      "source_name": "ESET Contagious Interview BeaverTail InvisibleFerret February 2025",
      "url": "https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"
    },
    {
      "source_name": "dtex DPRK 2025 structure ITworkers",
      "url": "https://reports.dtexsystems.com/DTEX-Exposing+DPRK+Cyber+Syndicate+and+Hidden+IT+Workforce.pdf"
    },
    {
      "source_name": "Securonix Contagious Interview DEVPOPPER April 2024",
      "url": "https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/"
    },
    {
      "source_name": "Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024",
      "url": "https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"
    },
    {
      "source_name": "PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023",
      "url": "https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"
    },
    {
      "source_name": "PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024",
      "url": "https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"
    }
  ]
}