Loading threat actor…
Contagious Interview is a North Korean state-sponsored, financially motivated threat activity cluster targeting software developers, IT professionals, and cryptocurrency specialists worldwide. It is also tracked as DeceptiveDevelopment, WaterPlum, and UNC5342, with overlapping activity associated with Void Dokkaebi and Famous Chollima. Its principal objectives include cryptocurrency theft, credential harvesting, and persistent access to corporate environments. Targets include organizations in technology, financial services, healthcare, energy, aerospace, defense, engineering, and legal services. Japanese and US authorities assess that WaterPlum actors and some associated North Korean IT workers operate under the 313 General Bureau of the Workers’ Party of Korea’s Munitions Industry Department. Operators impersonate recruiters and prospective employers, including fictitious cryptocurrency companies such as BlockNovas, Angeloper Agency, and SoftGlide. They approach victims through recruitment platforms, social media, freelance marketplaces, and developer services. Applicants are persuaded to execute malware-bearing coding assessments or commands purportedly fixing camera and conferencing problems. Execution mechanisms include npm lifecycle scripts, Visual Studio Code tasks, Git hooks, and malicious JavaScript disguised as fonts or images. The activity affects Windows, macOS, and Linux. Associated malware includes BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, StoatWaffle, GolangGhost, PylangGhost, and OmniStealer. These tools provide remote command execution, credential and session-cookie theft, keylogging, screenshot and clipboard collection, file exfiltration, and cryptocurrency-wallet theft. Operators use obfuscation, legitimate hosting services, proxies, and blockchain-assisted payload delivery or command-server discovery, including EtherHiding and NullReceiver, to complicate detection and infrastructure disruption. The cluster also uses stolen developer credentials to compromise public and private repositories, distribute poisoned packages and extensions, and conceal modifications by rewriting commit histories. Related fraudulent-employment operations, prominently tracked as Famous Chollima or WageMole, use stolen or fabricated identities and overseas facilitators to obtain remote IT jobs and generate revenue for North Korea. US-based laptop farms host employer-issued computers for remote access while concealing workers’ locations. Such access also enables proprietary-data theft and, in documented cases, extortion through threats to disclose stolen employer information. These employment schemes overlap operationally with the malware campaigns but are not synonymous with every Contagious Interview intrusion.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
222 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
95 malware families Mallory has associated with this actor across public reporting.
90 additional families tracked in Mallory.
2 CVEs Mallory has associated with this actor across public reporting. 2 of them are exploited in the wild (not necessarily by this actor).
916 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.