Contagious Interview

Also known as:DeceptiveDevelopment · Gwisin Gang · Tenacious Pungsan · DEV#POPPER · PurpleBravo · TAG-121

Overview

Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities.

Naming & attribution

Contagious Interview is tracked under 7 names across the industry. It uses 54 documented ATT&CK techniques — more than 86% of the 174 groups tracked here. Activity attributed since 2023.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
DeceptiveDevelopment	Matej Havranek
Gwisin Gang	Aleksandar Milenkoski, Sreekar Madabushi, Kenneth Kinion
Tenacious Pungsan	Ian Kretz, Sebastian Obregoso, Datadog Security Research Team
DEV#POPPER	Securonix Threat Research, D.Iuzvyk, T. Peck, O.Kolesnikov
PurpleBravo	Insikt Group
TAG-121	Insikt Group

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

T1204.005 Malicious Library — used by 1 of 174 groups
T1543.001 Launch Agent — used by 1 of 174 groups
T1546.004 Unix Shell Configuration Modification — used by 1 of 174 groups
T1547.013 XDG Autostart Entries — used by 1 of 174 groups
T1555.001 Keychain — used by 1 of 174 groups
T1588.007 Artificial Intelligence — used by 2 of 174 groups
T1681 Search Threat Vendor Data — used by 2 of 174 groups
T1683.001 Written Content — used by 2 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

APT-C-36 — 17 shared techniques (23% overlap)
MuddyWater Iran — 22 shared techniques (22% overlap)
Kimsuky North Korea — 31 shared techniques (20% overlap)
APT32 Vietnam — 22 shared techniques (20% overlap)
Magic Hound Iran — 21 shared techniques (19% overlap)
Mustang Panda China — 21 shared techniques (18% overlap)

Malware families with tracked indicators

One family attributed to Contagious Interview, with 1 deduplicated indicators observed across abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL over the corpus's window (up to three years, as of 2026-10-30). MITRE documents what a group does; these are the indicators its malware families have surfaced in that window.

Beavertail1 indicators

Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.

Capabilities

Custom malware/implant development — ATT&CK: 4 attributed custom malware families

TTPs — 54 techniques across 13 tactics

Stealth

Defense Impairment

T1685Disable or Modify Tools

Credential Access

T1555.001Keychain

Discovery

T1082System Information Discovery
T1083File and Directory Discovery

Command and Control

Exfiltration

T1041Exfiltration Over C2 Channel
T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
T1567Exfiltration Over Web Service
T1567.002Exfiltration to Cloud Storage

Impact

T1657Financial Theft

Tools & malware (4)

InvisibleFerret · BeaverTail · XORIndex Loader · HexEval Loader

Reporting (3)

Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms — Aleksandar Milenkoski, Sreekar Madabushi, Kenneth Kinion
Exposing DPRK's Cyber Syndicate and Hidden IT Workforce — Michael “Barni” Barnhart, DTEX, and Anonymous SMEs
DeceptiveDevelopment targets freelance developers — Matej Havranek