Contagious Interview (G1052) | Threat Actor Index

54

Techniques

4

Toolsets

0

CVEs Referenced

0

KEV Entries

About Contagious Interview

Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities.

View MITRE record ↗

Techniques by Tactic (54)

Reconnaissance

T1589 Gather Victim Identity InformationT1593 Search Open Websites/DomainsT1593.001 Social MediaT1593.003 Code RepositoriesT1681 Search Threat Vendor Data

Resource Development

T1583 Acquire InfrastructureT1583.001 DomainsT1583.003 Virtual Private ServerT1583.006 Web ServicesT1585 Establish AccountsT1585.001 Social Media AccountsT1585.002 Email AccountsT1587 Develop CapabilitiesT1587.001 MalwareT1588.002 ToolT1588.007 Artificial IntelligenceT1608.001 Upload MalwareT1683.001 Written ContentT1683.002 Audio-Visual Content

Initial Access

T1566.003 Spearphishing via Service

Execution

T1059.003 Windows Command ShellT1059.004 Unix ShellT1059.005 Visual BasicT1059.006 PythonT1059.007 JavaScriptT1204.001 Malicious LinkT1204.002 Malicious FileT1204.004 Malicious Copy and PasteT1204.005 Malicious Library

Persistence

T1543.001 Launch AgentT1546.004 Unix Shell Configuration ModificationT1547.001 Registry Run Keys / Startup FolderT1547.013 XDG Autostart Entries

Privilege Escalation

T1543.001 Launch AgentT1546.004 Unix Shell Configuration ModificationT1547.001 Registry Run Keys / Startup FolderT1547.013 XDG Autostart Entries

Stealth

T1027.010 Command ObfuscationT1027.013 Encrypted/Encoded FileT1036 MasqueradingT1070.004 File DeletionT1480 Execution GuardrailsT1497 Virtualization/Sandbox EvasionT1684.001 Impersonation

Defence Impairment

T1685 Disable or Modify Tools

Credential Access

T1555.001 Keychain

Discovery

T1082 System Information DiscoveryT1083 File and Directory DiscoveryT1497 Virtualization/Sandbox Evasion

Command & Control

T1071.003 Mail ProtocolsT1090 ProxyT1219.002 Remote Desktop SoftwareT1571 Non-Standard PortT1573.001 Symmetric Cryptography

Exfiltration

T1041 Exfiltration Over C2 ChannelT1048.003 Exfiltration Over Unencrypted Non-C2 ProtocolT1567 Exfiltration Over Web ServiceT1567.002 Exfiltration to Cloud Storage

Impact

T1657 Financial Theft

Toolsets (4)

🐛

BeaverTail S1246

Malware · Linux, macOS, Windows

🐛

HexEval Loader S1249

Malware · Linux, macOS, Windows

🐛

InvisibleFerret S1245

Malware · Linux, macOS, Windows

🐛

XORIndex Loader S1248

Malware · Windows

References & Reports (11)

↑