ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Threat actors

G1052threat actor

Contagious Interview

a.k.a. DeceptiveDevelopment, Gwisin Gang, Tenacious Pungsan, DEV#POPPER, PurpleBravo, TAG-121

Contagious Interview is a North Korea–aligned threat group active since 2023. The group conducts both cyberespionage and financially motivated operations, including the theft of cryptocurrency and user credentials. Contagious Interview targets Windows, Linux, and macOS systems, with a particular focus on individuals engaged in software development and cryptocurrency-related activities.

MITRE ATT&CK ↗

Linked entities · 24

usesT1555.001Keychain usesT1585Establish Accounts usesT1083File and Directory Discovery usesT1583.006Web Services usesT1571Non-Standard Port usesT1204.005Malicious Library usesS1245InvisibleFerret usesS1246BeaverTail usesT1219.002Remote Desktop Software usesT1036Masquerading usesT1204.002Malicious File usesT1497Virtualization/Sandbox Evasion usesT1567Exfiltration Over Web Service usesT1059.004Unix Shell usesT1587.001Malware usesT1593.003Code Repositories usesT1583.001Domains usesT1566.003Spearphishing via Service usesT1546.004Unix Shell Configuration Modifica…usesT1683.001Written Content usesT1685Disable or Modify Tools usesT1681Search Threat Vendor Data usesT1059.003Windows Command Shell usesT1657Financial Theft