Threat actor · all actors

Contagious InterviewG1052 unknown

aka Contagious Interview, DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121

Last updated: 2026-07-03

0attributed CVEs

71ATT&CK techniques

0.0IDF score (tooling uniqueness)

0exclusive CVEs

—years active

About this actor

[Contagious Interview](https://attack.mitre.org/groups/G1052) is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. [Contagious Interview](https://attack.mitre.org/groups/G1052) targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities. (Citation: Validin Contagious Interview North Korea ClickFix January 2025)(Citation: Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: Datadog Contagious Interview Tenacious Pungsan October 2024)(Citation: Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025)(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)(Citation: Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023)(Citation: PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024)

Source: MITRE ATT&CK

Activity timeline

No activity events recorded.

Profile

CVE	Risk	CVSS	EPSS	Published	Products
No attributed CVEs.

Mitigating controls (NIST 800-53)

Control	Techniques covered	Coverage
`SI-4`	32 / 71	45%
`SI-3`	31 / 71	44%
`CM-2`	28 / 71	39%
`CM-6`	28 / 71	39%
`CA-7`	27 / 71	38%
`AC-3`	22 / 71	31%
`AC-6`	21 / 71	30%
`CM-7`	19 / 71	27%
`AC-2`	18 / 71	25%
`AC-4`	17 / 71	24%
`SC-7`	17 / 71	24%
`SI-7`	17 / 71	24%
`SI-10`	14 / 71	20%
`AC-17`	10 / 71	14%
`SI-2`	10 / 71	14%

Co-occurring actors

None.