Contagious Interview

Introduction

Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities. Validin Contagious Interview North Korea ClickFix January 2025 Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024 Datadog Contagious Interview Tenacious Pungsan October 2024 Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025 ESET Contagious Interview BeaverTail InvisibleFerret February 2025 Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024 PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023 PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024

Activities and Tactics

Information pending cataloguing.

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

• T1555.001 Keychain
• T1585 Establish Accounts
• T1083 File and Directory Discovery
• T1583.006 Web Services
• T1571 Non-Standard Port
• T1204.005 Malicious Library
• T1219.002 Remote Desktop Software
• T1036 Masquerading
• T1204.002 Malicious File
• T1497 Virtualization/Sandbox Evasion
• T1567 Exfiltration Over Web Service
• T1059.004 Unix Shell
• T1587.001 Malware
• T1593.003 Code Repositories
• T1583.001 Domains
• T1566.003 Spearphishing via Service
• T1546.004 Unix Shell Configuration Modification
• T1683.001 Written Content
• T1685 Disable or Modify Tools
• T1681 Search Threat Vendor Data
• T1059.003 Windows Command Shell
• T1657 Financial Theft
• T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
• T1059.007 JavaScript
• T1547.013 XDG Autostart Entries
• T1587 Develop Capabilities
• T1070.004 File Deletion
• T1588.002 Tool
• T1543.001 Launch Agent
• T1041 Exfiltration Over C2 Channel
• T1593.001 Social Media
• T1583 Acquire Infrastructure
• T1027.013 Encrypted/Encoded File
• T1567.002 Exfiltration to Cloud Storage
• T1684.001 Impersonation
• T1204.004 Malicious Copy and Paste
• T1059.006 Python
• T1589 Gather Victim Identity Information
• T1583.003 Virtual Private Server
• T1588.007 Artificial Intelligence
• T1090 Proxy
• T1573.001 Symmetric Cryptography
• T1204.001 Malicious Link
• T1071.003 Mail Protocols
• T1082 System Information Discovery
• T1593 Search Open Websites/Domains
• T1027.010 Command Obfuscation
• T1608.001 Upload Malware
• T1059.005 Visual Basic
• T1480 Execution Guardrails
• T1585.001 Social Media Accounts
• T1547.001 Registry Run Keys / Startup Folder
• T1585.002 Email Accounts
• T1683.002 Audio-Visual Content

ATT&CK technique IDs (denormalized)

• T1027.010
• T1027.013
• T1036
• T1041
• T1048.003
• T1059.003
• T1059.004
• T1059.005
• T1059.006
• T1059.007
• T1070.004
• T1071.003
• T1082
• T1083
• T1090
• T1204.001
• T1204.002
• T1204.004
• T1204.005
• T1219.002
• T1480
• T1497
• T1543.001
• T1546.004
• T1547.001
• T1547.013
• T1555.001
• T1566.003
• T1567
• T1567.002
• T1571
• T1573.001
• T1583
• T1583.001
• T1583.003
• T1583.006
• T1585
• T1585.001
• T1585.002
• T1587
• T1587.001
• T1588.002
• T1588.007
• T1589
• T1593
• T1593.001
• T1593.003
• T1608.001
• T1657
• T1681
• T1683.001
• T1683.002
• T1684.001
• T1685

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

• CyberGate
• Cyber Eye RAT
• Windows Remote Desktop

MITRE ATT&CK Software

• InvisibleFerret (S1245) — malware
• BeaverTail (S1246) — malware
• XORIndex Loader (S1248) — malware
• HexEval Loader (S1249) — malware

Attribution and Evidence

Information pending cataloguing.

References

[1] mitre-attack [8] Sentinel One Contagious Interview ClickFix September 2025 Aleksandar Milenkoski, Sreekar Madabushi, Kenneth Kinion. (2025, September 4). Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms. Retrieved October 20, 2025. [9] Validin Contagious Interview North Korea ClickFix January 2025 Efstratios Lontzetidis. (2025, January 16). Lazarus APT: Techniques for Hunting Contagious Interview. Retrieved October 20, 2025. [10] Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024 eSentire Threat Response Unit (TRU). (2024, November 14). Bored BeaverTail & InvisibleFerret Yacht Club – A Lazarus Lure Pt.2. Retrieved October 17, 2025. [11] Datadog Contagious Interview Tenacious Pungsan October 2024 Ian Kretz, Sebastian Obregoso, Datadog Security Research Team. (2024, October 24). Tenacious Pungsan: A DPRK threat actor linked to Contagious Interview. Retrieved October 20, 2025. [12] Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025 Insikt Group. (2025, February 13). Inside the Scam: North Korea’s IT Worker Threat. Retrieved October 17, 2025. [13] ESET Contagious Interview BeaverTail InvisibleFerret February 2025 Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025. [14] dtex DPRK 2025 structure ITworkers Michael “Barni” Barnhart, DTEX, and Anonymous SMEs. (2025, May 14). Exposing DPRK’s Cyber Syndicate and Hidden IT Workforce. Retrieved September 3, 2025. [15] Securonix Contagious Interview DEVPOPPER April 2024 Securonix Threat Research, D.Iuzvyk, T. Peck, O.Kolesnikov. (2024, April 24). Analysis of DEV#POPPER: New Attack Campaign Targeting Software Developers Likely Associated With North Korean Threat Actors. Retrieved October 20, 2025. [16] Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024 Seongsu Park. (2024, November 4). From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West. Retrieved October 17, 2025. [17] PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023 Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025. [18] PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024 Unit42. (2024, October 9). Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware. Retrieved October 17, 2025.