Opening Forensia workspaceacquiring
Loading the current evidence view. Navigation and account controls remain available.
Loading recent evidenceacquiring
Threat actors
Loading the current evidence view. Navigation and account controls remain available.
Also known as: DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121
54
techniques
4
software
11,631
corpus matches
profile
Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities.
techniques
54 attributed · most-instrumented first
software
4 malware & tools attributed
InvisibleFerret
S1245
BeaverTail
S1246
XORIndex Loader
S1248
HexEval Loader
S1249
read this carefully
11,631 corpus matches is not attribution
That count is indicators which exhibit techniques Contagious Interview is known to use. Many unrelated operators use the same techniques. Treat it as a shared-technique signal for hunting, never as first-party attribution to this group.
indicators exhibiting these techniques
Top by severity: each resolves to its own verdict.
+42 more techniques
showing 30 of 11,631
known aliases
Vendors name the same group differently. Searching any alias reaches this profile.