At a glance
Facts
- North Korean threat actor group behind the Contagious Interview campaign
- Active since at least 2022
Contagious Interview
Also known as DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121, CL-STA-0240, Famous Chollima, UNC5342, Void Dokkaebi
Tracked as
G1052
CL-STA-0240
Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities.
Threat intelligence assessment
Activity timeline
Facts
- Compromised at least 30,000 devices in over 100 countries
- Siphoned funds or credentials from over 7,000 cryptocurrency wallets
- Estimated to have stolen at least $10.71 million in cryptocurrency
Attribution assessment
Facts
- WaterPlum is suspected to operate under the 313 General Bureau of the Munitions Industry Department
- WaterPlum and North Korean IT workers (PurpleDelta or Wagemole) are said to be deeply intertwined
- The Contagious Interview campaign is attributed to North Korean threat actors and tracked under multiple aliases
Initial access and identity targets
Facts
- Targets job seekers via social media platforms like LinkedIn
- Poses as prospective employers and recruiters with lucrative job offers
- Instructs targets to complete job assessments or coding tests
Capabilities and evasion
Facts
- Conducts multi-step infection chains leading to deployment of various malware families
- Uses backdoor access to deliver remote access trojans for persistent access and data exfiltration
- Operates laptop farms for remote device management
- Infiltrates organizations employing targeted developers for espionage and intellectual property theft
- Uses AI to craft fictitious identities
Infrastructure patterns
Facts
- Operates laptop farms in Japan for remote device management
- Uses VPN services like Astrill VPN and Mullvad to obtain exit nodes in target countries
- Uses online chat platforms to communicate with developers
- Operates Discord servers for recruiting proxies
Communication and pressure channels
Facts
- Uses online chat platforms to communicate with U.S. and Japanese developers
- Employs AI-generated job advertisements to recruit proxy workers
Observed targeting
Facts
- Primary targets are individual web designers, engineers, and specialists in cryptocurrency, blockchain, and Web3 technologies
- Targets software developers and IT professionals
- Primary targets appear to be the U.S. and Japan
Defender guidance
Facts
- A laptop farm operated by a facilitator in Japan has been identified and dismantled
Reported detail
Facts
- WaterPlum, a North Korean threat group active since at least 2022, compromised over 30,000 devices across 100+ countries using fake job recruitment lures targeting developers and crypto specialists.
- The group stole approximately $10.71 million in cryptocurrency and credentials from over 7,000 wallets by deploying multiple malware families through social engineering.
- WaterPlum operates laptop farms and uses VPN services to conduct remote attacks while enabling North Korean IT workers to impersonate victims and secure employment in Western companies.
- The group is suspected to operate under North Korea's 313 General Bureau and increasingly uses AI-generated identities to expand its proxy hiring scheme globally.
- International agencies from Japan, the U.S., Australia, and Germany coordinated in documenting the campaign, which targets Web3 and cryptocurrency professionals primarily in the U.S. and Japan.
Activity timeline
A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.
Cataloged
Indicator11 indicators cataloged
Types: tool.
Cataloged
IdentityAlias: CL-STA-0240
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: DeceptiveDevelopment
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: DEV#POPPER
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Famous Chollima
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Gwisin Gang
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: PurpleBravo
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Tenacious Pungsan
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: UNC5342
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Void Dokkaebi
Reviewed identity mapping approved on this date.
Cataloged
IdentityTracking identifier: CL-STA-0240
Reviewed identity mapping approved on this date.
Cataloged
IdentityTracking identifier: G1052
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: DeceptiveDevelopment
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Gwisin Gang
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Tenacious Pungsan
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: DEV#POPPER
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: PurpleBravo
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: TAG-121
Reviewed identity mapping approved on this date.
Identity and attribution
Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.
Name map
Contagious InterviewCanonical Name
WaterPlumCanonical Name
DEV#POPPERAlias
DeceptiveDevelopmentAlias
Gwisin GangAlias
PurpleBravoAlias
TAG-121Alias
Tenacious PungsanAlias
CL-STA-0240Alias
Famous ChollimaAlias
UNC5342Alias
Void DokkaebiAlias
G1052Tracking Id
CL-STA-0240Tracking Id
Loading CVEs, techniques, indicators, malware, victims, and activity...