Contagious Interview
Contagious Interview is a North Korea-aligned threat activity cluster associated in the provided reporting with Famous Chollima, Void Dokkaebi, UNC5342, DeceptiveDevelopment, Dev#Popper, and related aliases including BeaverTail, InvisibleFerret, OtterCookie, Gwisin Gang, and Tenacious Pungsan. The cluster is described as DPRK-linked and in multiple sources as operating under or alongside the Lazarus umbrella. The activity primarily targets software developers, especially in cryptocurrency, blockchain, Web3, DeFi, and broader technology sectors, though reporting also notes targeting of finance, education, business services, and financial services organizations. A recurring tradecraft pattern is social engineering through fake recruiter personas, fraudulent job offers, coding challenges, code review requests, and fake interview or skill-testing workflows. Operators commonly use LinkedIn, job boards, email, GitHub, GitLab, Bitbucket, Google Docs, and lure websites impersonating real companies or fabricated firms. Some variants use ClickFix-style prompts or fake video-driver/camera troubleshooting flows to induce execution. Malware and tooling directly associated in the content include BeaverTail, InvisibleFerret, JADESNOW, OtterCookie, ContagiousDrop, and in some reporting supply-chain-delivered JavaScript loaders and npm/package ecosystem abuse. Reported objectives include theft of cryptocurrency wallets, browser credentials, password-manager data, cookies, SSH keys, cloud configuration data, and other sensitive information, with some reporting also noting persistent access, remote control, and possible cyberespionage or foothold establishment inside technology companies. The content also describes operational behaviors beyond victim compromise. Contagious Interview operators were observed abusing cyber threat intelligence platforms such as Validin, monitoring Maltrail and VirusTotal for exposure of their infrastructure, rapidly replacing disrupted infrastructure, and exhibiting repeated OPSEC failures through exposed directories, logs, and Node.js applications. Additional reporting links the cluster to abuse of Google Docs for fake job lures and facilitator recruitment, software supply-chain activity involving malicious npm packages and a compromised Packagist development branch, and infrastructure patterns including blockchain-based dead-drop or EtherHiding delivery mechanisms. Related or overlapping activity in the content includes the North Korean fake IT worker scheme tracked as WageMole/Wagemole and reporting that Famous Chollima is active in both developer-targeting malware campaigns and fraudulent employment operations. Proofpoint reporting cited in the content notes strong overlaps between UNK_DeadDrop and Contagious Interview in targeting, social engineering, and theft goals, while tracking UNK_DeadDrop separately due to distinct telemetry and infrastructure.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Software & Services
Where they target
Geographies tied to known operations.
- 🇺🇦 Ukraine
- 🇺🇸 United States
- 🇩🇪 Germany
Where they're from
Attributed origin per open-source reporting.
- KP
- RU
- CN
- PK
Tradecraft
68 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
38 malware families attributed to this actor across reporting.
33 additional families tracked in Mallory.
Associated vulnerabilities
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
"A critical remote code execution (RCE) vulnerability, identified as CVE-2025-55182 and dubbed React2Shell, exists within the React Server Components (RSC) architecture, allowing unauthenticated attackers to execute arbitrary code..."
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
Observables
534 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
North Korean state-backed intrusion activity focused on the tech sector, including posing as remote IT workers and recruiters to infiltrate companies, steal intellectual property and sensitive information, extort victims, and target blockchain developers to steal cryptocurrency.
Runs two related campaigns: the IT Worker scheme to obtain salaries via fraudulent insider employment, and Contagious Interview targeting developers with fake job lures and coding tests that lead to infostealing malware and cryptocurrency theft. The group also uses Google Docs to host and update malicious job adverts, coding assessments, and proxy interviewee recruitment materials.
A previously known threat actor cluster that overlaps strongly with UNK_DeadDrop and is associated in the content with North Korea-aligned developer-targeting social engineering activity.
North Korean campaign targeting developers, associated with social engineering around job opportunities and theft of cryptocurrency wallets and credentials.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.