{
  "id": "contagious-interview",
  "name": "Contagious Interview",
  "aliases": [
    "DeceptiveDevelopment",
    "Gwisin Gang",
    "Tenacious Pungsan",
    "DEV#POPPER",
    "PurpleBravo",
    "TAG-121"
  ],
  "domain": "cyber",
  "country": "PRK",
  "category": "State-sponsored cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "PRK"
  ],
  "summary": "Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials.",
  "specs": [
    {
      "k": "sponsor",
      "v": "North Korea-aligned",
      "src": [
        "mitre-g1052"
      ],
      "conf": "high"
    },
    {
      "k": "active_since",
      "v": 2023,
      "src": [
        "mitre-g1052"
      ],
      "conf": "medium",
      "note": "At least 2023"
    },
    {
      "k": "attack_id",
      "v": "G1052",
      "src": [
        "mitre-g1052"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities.",
      "src": [
        "mitre-g1052"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 54,
      "src": [
        "mitre-g1052"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "BeaverTail, HexEval Loader, InvisibleFerret, XORIndex Loader",
      "src": [
        "mitre-g1052"
      ],
      "conf": "high",
      "note": "4 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G1052)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/contagious-interview.html",
  "sources": {
    "mitre-g1052": {
      "title": "Contagious Interview, Group G1052",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G1052/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}