Loading threat actor…
Contagious Interview is a North Korean state-sponsored, financially motivated cyber operation targeting software developers, IT professionals, and cryptocurrency specialists worldwide. It is also tracked as DeceptiveDevelopment, WaterPlum, and UNC5342, with related operations tracked under Famous Chollima and Void Dokkaebi. Its principal objectives are cryptocurrency theft, credential harvesting, sensitive-data collection, and persistent access to corporate networks. Its operators have been linked to the 313 General Bureau of the Workers’ Party of Korea’s Munitions Industry Department. Operators impersonate recruiters and prospective employers through professional networks, freelance marketplaces, and fabricated companies, including BlockNovas, Angeloper Agency, and SoftGlide. Victims are persuaded to execute trojanized coding assessments, install purported conferencing updates, or run commands presented as fixes for camera and microphone problems. Malicious repositories exploit npm lifecycle scripts, Visual Studio Code tasks, and Git hooks, while obfuscated JavaScript may be disguised as image or font assets. Payloads affect Windows, macOS, and Linux. Associated malware includes BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, StoatWaffle, GolangGhost, PylangGhost, OmniStealer, and DEV#POPPER. These tools support browser-password and session-cookie theft, cryptocurrency-wallet collection, developer-secret harvesting, keylogging, screenshot and clipboard collection, file exfiltration, and remote command execution. Compromised developer systems provide access to employers and clients and support further lateral movement. The operation has expanded into software supply-chain compromise, using stolen Git credentials, SSH keys, and access tokens to modify public and private repositories. Attackers conceal changes by rewriting commit histories and distribute poisoned projects through package ecosystems and browser-extension marketplaces. Blockchain-assisted techniques, including EtherHiding and NullReceiver, retrieve payloads or locate command-and-control infrastructure through Ethereum and BNB Smart Chain. Decentralized hosting, proxies, VPNs, and compromised systems further complicate disruption. The operation overlaps with North Korean fraudulent IT-employment networks through shared operators and infrastructure. Those networks use stolen or fabricated identities and remotely accessible laptop farms to obtain employment and generate revenue for North Korea; they should not be treated as universally interchangeable with the malware-delivery campaign.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
223 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
95 malware families Mallory has associated with this actor across public reporting.
90 additional families tracked in Mallory.
2 CVEs Mallory has associated with this actor across public reporting. 2 of them are exploited in the wild (not necessarily by this actor).
927 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.