Threat Intelligence Garden

Operation Contagious Interview

3 min read

Operation Contagious Interview

Description

A subgroup of Lazarus Group, Hidden Cobra, Labyrinth Chollima.

(Palo Alto) Unit 42 researchers recently discovered two separate campaigns targeting job-seeking activities linked to state-sponsored threat actors associated with the Democratic People’s Republic of Korea (DPRK), commonly known as North Korea. We call the first campaign “Contagious Interview,” where threat actors pose as employers (often anonymously or with vague identities) to lure software developers into installing malware through the interview process. This malware creates the potential for various types of theft. We attribute with moderate confidence that Contagious Interview is run by a North Korea state-sponsored threat actor.

We call the second campaign “Wagemole,” where threat actors seek unauthorized employment with organizations based in the US and other parts of the world, with potential for both financial gain and espionage. We attribute with high confidence that Wagemole is a North Korea state-sponsored threat. Activity from both campaigns remains an ongoing active threat.

Names

NameName-Giver
Operation Contagious InterviewPalo Alto
WagemolePalo Alto
Tenacious PungsanDatadog Security Research
Nickel TapestrySecureWorks
UNC5267Mandiant
WaterPlumNTT
PurpleBravoRecorded Future

Country

Motivation

  • Information theft and espionage

First Seen

2022

Tools

Operations

Counter Operations

Information

Other Information

Uuid

6a507717-ba17-44cb-af22-ebc5aea59b67

Last Card Change

2025-06-28

Graph View

Backlinks