Contagious Interview
Also reported as PurpleBravo, Wagemole, Nickel Tapestry, UNC5267, WaterPlum and 13 other names. Linked to North Korea by four sources.
Reports per quarter
Techniques seen in the last two years
- T1059.007 15 reports in ATT&CK
- T1041 14 reports in ATT&CK
- T1082 14 reports in ATT&CK
- T1204.002 14 reports in ATT&CK
- T1083 12 reports in ATT&CK
- T1105 12 reports reports only
- T1555.003 12 reports reports only
- T1005 10 reports reports only
- T1071.001 9 reports reports only
- T1119 9 reports reports only
Show all 277 techniques Show fewer
- T1195.002 9 reports reports only
- T1217 9 reports reports only
- T1657 9 reports in ATT&CK
- T1027 8 reports reports only
- T1027.013 8 reports in ATT&CK
- T1555.001 8 reports in ATT&CK
- T1566.003 8 reports in ATT&CK
- T1608.001 8 reports in ATT&CK
- T1059 7 reports reports only
- T1059.006 7 reports in ATT&CK
- T1546.016 6 reports reports only
- T1056.001 5 reports reports only
- T1566.001 5 reports reports only
- T1566.002 5 reports reports only
- T1571 5 reports in ATT&CK
- T1053.005 4 reports reports only
- T1115 4 reports reports only
- T1195 4 reports reports only
- T1219 4 reports reports only
- T1547.001 4 reports in ATT&CK
- T1555 4 reports reports only
- T1078 3 reports reports only
- T1091 3 reports reports only
- T1095 3 reports reports only
- T1102.001 3 reports reports only
- T1140 3 reports reports only
- T1189 3 reports reports only
- T1190 3 reports reports only
- T1547 3 reports reports only
- T1566 3 reports reports only
- T1010 2 reports reports only
- T1012 2 reports reports only
- T1016 2 reports reports only
- T1020 2 reports reports only
- T1021.001 2 reports reports only
- T1036 2 reports in ATT&CK
- T1036.005 2 reports reports only
- T1048 2 reports reports only
- T1055 2 reports reports only
- T1056 2 reports reports only
- T1057 2 reports reports only
- T1059.003 2 reports in ATT&CK
- T1059.004 2 reports in ATT&CK
- T1070.004 2 reports in ATT&CK
- T1071 2 reports reports only
- T1071.002 2 reports reports only
- T1074.001 2 reports reports only
- T1087.004 2 reports reports only
- T1124 2 reports reports only
- T1132.001 2 reports reports only
- T1133 2 reports reports only
- T1199 2 reports reports only
- T1204 2 reports reports only
- T1204.001 2 reports in ATT&CK
- T1496 2 reports reports only
- T1497 2 reports in ATT&CK
- T1497.001 2 reports reports only
- T1518 2 reports reports only
- T1539 2 reports reports only
- T1543.003 2 reports reports only
- T1560 2 reports reports only
- T1560.002 2 reports reports only
- T1567 2 reports in ATT&CK
- T1573 2 reports reports only
- T1573.001 2 reports in ATT&CK
- T1573.002 2 reports reports only
- T1580 2 reports reports only
- T1583.003 2 reports in ATT&CK
- T1585.001 2 reports in ATT&CK
- T1587.001 2 reports in ATT&CK
- T1588.003 2 reports reports only
- T1608 2 reports reports only
- T1614 2 reports reports only
- T1659 2 reports reports only
- T1001 1 report reports only
- T1003 1 report reports only
- T1007 1 report reports only
- T1008 1 report reports only
- T1016.001 1 report reports only
- T1018 1 report reports only
- T1021 1 report reports only
- T1021.002 1 report reports only
- T1021.004 1 report reports only
- T1021.005 1 report reports only
- T1021.006 1 report reports only
- T1025 1 report reports only
- T1027.002 1 report reports only
- T1030 1 report reports only
- T1033 1 report reports only
- T1037 1 report reports only
- T1037.001 1 report reports only
- T1039 1 report reports only
- T1040 1 report reports only
- T1046 1 report reports only
- T1047 1 report reports only
- T1048.003 1 report in ATT&CK
- T1049 1 report reports only
- T1053 1 report reports only
- T1053.003 1 report reports only
- T1053.006 1 report reports only
- T1055.001 1 report reports only
- T1055.002 1 report reports only
- T1055.003 1 report reports only
- T1055.004 1 report reports only
- T1055.009 1 report reports only
- T1055.012 1 report reports only
- T1059.001 1 report reports only
- T1059.002 1 report reports only
- T1059.005 1 report in ATT&CK
- T1059.009 1 report reports only
- T1059.010 1 report reports only
- T1059.011 1 report reports only
- T1068 1 report reports only
- T1069 1 report reports only
- T1069.001 1 report reports only
- T1069.002 1 report reports only
- T1069.003 1 report reports only
- T1070 1 report reports only
- T1071.004 1 report reports only
- T1072 1 report reports only
- T1074 1 report reports only
- T1074.002 1 report reports only
- T1078.004 1 report reports only
- T1087 1 report reports only
- T1087.001 1 report reports only
- T1087.002 1 report reports only
- T1090 1 report in ATT&CK
- T1090.001 1 report reports only
- T1090.003 1 report reports only
- T1098 1 report reports only
- T1098.001 1 report reports only
- T1098.003 1 report reports only
- T1098.004 1 report reports only
- T1098.005 1 report reports only
- T1098.006 1 report reports only
- T1098.007 1 report reports only
- T1102 1 report reports only
- T1102.002 1 report reports only
- T1104 1 report reports only
- T1113 1 report reports only
- T1114 1 report reports only
- T1114.001 1 report reports only
- T1114.002 1 report reports only
- T1114.003 1 report reports only
- T1120 1 report reports only
- T1123 1 report reports only
- T1125 1 report reports only
- T1129 1 report reports only
- T1132 1 report reports only
- T1134 1 report reports only
- T1134.001 1 report reports only
- T1135 1 report reports only
- T1136 1 report reports only
- T1136.001 1 report reports only
- T1136.002 1 report reports only
- T1137 1 report reports only
- T1137.006 1 report reports only
- T1195.001 1 report reports only
- T1200 1 report reports only
- T1201 1 report reports only
- T1203 1 report reports only
- T1204.004 1 report in ATT&CK
- T1205 1 report reports only
- T1210 1 report reports only
- T1213 1 report reports only
- T1213.001 1 report reports only
- T1213.002 1 report reports only
- T1213.003 1 report reports only
- T1219.002 1 report in ATT&CK
- T1480 1 report in ATT&CK
- T1482 1 report reports only
- T1484 1 report reports only
- T1484.001 1 report reports only
- T1485 1 report reports only
- T1486 1 report reports only
- T1489 1 report reports only
- T1490 1 report reports only
- T1491.002 1 report reports only
- T1496.001 1 report reports only
- T1505 1 report reports only
- T1505.003 1 report reports only
- T1505.004 1 report reports only
- T1518.001 1 report reports only
- T1529 1 report reports only
- T1530 1 report reports only
- T1534 1 report reports only
- T1537 1 report reports only
- T1538 1 report reports only
- T1543 1 report reports only
- T1543.002 1 report reports only
- T1543.004 1 report reports only
- T1546 1 report reports only
- T1546.003 1 report reports only
- T1546.004 1 report in ATT&CK
- T1546.008 1 report reports only
- T1546.012 1 report reports only
- T1546.015 1 report reports only
- T1547.002 1 report reports only
- T1547.005 1 report reports only
- T1547.009 1 report reports only
- T1548 1 report reports only
- T1548.002 1 report reports only
- T1550 1 report reports only
- T1550.001 1 report reports only
- T1550.002 1 report reports only
- T1550.004 1 report reports only
- T1552.001 1 report reports only
- T1552.004 1 report reports only
- T1553.002 1 report reports only
- T1554 1 report reports only
- T1555.005 1 report reports only
- T1556 1 report reports only
- T1556.006 1 report reports only
- T1556.009 1 report reports only
- T1557 1 report reports only
- T1559 1 report reports only
- T1560.001 1 report reports only
- T1564.001 1 report reports only
- T1564.003 1 report reports only
- T1565 1 report reports only
- T1565.001 1 report reports only
- T1566.004 1 report reports only
- T1567.001 1 report reports only
- T1567.002 1 report in ATT&CK
- T1567.004 1 report reports only
- T1569 1 report reports only
- T1569.002 1 report reports only
- T1570 1 report reports only
- T1572 1 report reports only
- T1574 1 report reports only
- T1574.001 1 report reports only
- T1574.011 1 report reports only
- T1578 1 report reports only
- T1578.005 1 report reports only
- T1583 1 report in ATT&CK
- T1583.006 1 report in ATT&CK
- T1584 1 report reports only
- T1584.005 1 report reports only
- T1585 1 report in ATT&CK
- T1585.002 1 report in ATT&CK
- T1586 1 report reports only
- T1587 1 report in ATT&CK
- T1587.003 1 report reports only
- T1588 1 report reports only
- T1588.004 1 report reports only
- T1588.007 1 report in ATT&CK
- T1589 1 report in ATT&CK
- T1589.001 1 report reports only
- T1595 1 report reports only
- T1595.002 1 report reports only
- T1598 1 report reports only
- T1602 1 report reports only
- T1602.001 1 report reports only
- T1602.002 1 report reports only
- T1608.002 1 report reports only
- T1608.003 1 report reports only
- T1608.004 1 report reports only
- T1608.005 1 report reports only
- T1608.006 1 report reports only
- T1609 1 report reports only
- T1613 1 report reports only
- T1614.001 1 report reports only
- T1615 1 report reports only
- T1619 1 report reports only
- T1622 1 report reports only
- T1652 1 report reports only
- T1654 1 report reports only
Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.
Also listed by ATT&CK
CVEs named in reports
- CVE-2017-0144 KEV ransomware
- CVE-2020-0688 KEV ransomware
- CVE-2020-3529
- CVE-2021-34523 KEV ransomware
- CVE-2022-30190 KEV ransomware
- CVE-2023-20198 KEV
- CVE-2023-20273 KEV
- CVE-2023-23397 KEV
- CVE-2023-27532 KEV ransomware
- CVE-2023-29324
- CVE-2023-29360 KEV
- CVE-2023-35384
Show all 55 CVEs Show fewer
- CVE-2023-36802 KEV
- CVE-2023-36884 KEV ransomware
- CVE-2023-38831 KEV ransomware
- CVE-2023-46805 KEV ransomware
- CVE-2023-48788 KEV ransomware
- CVE-2024-0012 KEV ransomware
- CVE-2024-11182 KEV
- CVE-2024-20953 KEV
- CVE-2024-21287 KEV
- CVE-2024-21887 KEV ransomware
- CVE-2024-21893 KEV ransomware
- CVE-2024-21983
- CVE-2024-26229
- CVE-2024-32113 KEV
- CVE-2024-3400 KEV ransomware
- CVE-2024-35250 KEV
- CVE-2024-36104
- CVE-2024-38245
- CVE-2024-38856 KEV
- CVE-2024-42009 KEV
- CVE-2024-43554
- CVE-2024-45195 KEV
- CVE-2024-4577 KEV ransomware
- CVE-2024-47575 KEV
- CVE-2024-49039 KEV ransomware
- CVE-2024-5910 KEV
- CVE-2024-9463 KEV
- CVE-2024-9464
- CVE-2024-9465 KEV
- CVE-2024-9466
- CVE-2024-9467
- CVE-2024-9474 KEV ransomware
- CVE-2024-9680 KEV ransomware
- CVE-2025-0282 KEV ransomware
- CVE-2025-10035 KEV ransomware
- CVE-2025-24893 KEV
- CVE-2025-55182 KEV ransomware
- CVE-2025-6218 KEV
- CVE-2025-66478
- CVE-2025-8088 KEV ransomware
- CVE-2026-1281 KEV
- CVE-2026-1340 KEV
- CVE-2026-21509 KEV
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
Show all 150 reports Show fewer
-
Subgroup: Operation Contagious Interview - Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Subgroup: Operation Contagious Interview - Threat Group Cards: A Threat Actor Encyclopedia
-
InvisibleFerret (Malware Family)
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor InvisibleFerret (Malware Family)
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor BeaverTail (Malware Family)
-
Analyzing%20the%20BeaverTail%20Infostealer.pdf
The original link failed its last check. Original publisher Detailsfor Analyzing%20the%20BeaverTail%20Infostealer.pdf
-
The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Dependency hijacking: Dissecting North Korea�s new wave of DeFi-themed open source attacks targeting developers
Newest first. Details opens the report in Explore.