← All threat actors
Contagious InterviewG1052 ↗
Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities.
Motivation
Unknown
Suspected origin
Unknown
Reports / IOCs (VT)
35 reports · 0 IOCs
Reported activity
2025 – 2026
Targeted industries
—Targeted regions
—ATT&CK techniques in reports
- T1681 Search Threat Vendor Data2
- T1059 Command and Scripting Interpreter2
- T1195.001 Compromise Software Dependencies and Development Tools1
- T1105 Ingress Tool Transfer1
- T1070.006 Timestomp1
- T1078 Valid Accounts1
- T1098 Account Manipulation1
- T1195 Supply Chain Compromise1
- T1195.002 Compromise Software Supply Chain1
- T1552 Unsecured Credentials1
- T1027 Obfuscated Files or Information1
- T1036 Masquerading1
- T1041 Exfiltration Over C2 Channel1
- T1048 Exfiltration Over Alternative Protocol1
- T1070 Indicator Removal1
- T1071 Application Layer Protocol1
- T1082 System Information Discovery1
- T1083 File and Directory Discovery1
- T1090 Proxy1
- T1204 User Execution1