Remote Worker Fraud / Contagious Interview

Two halves run through the same hiring process. In the IT-worker scheme the operator is the candidate: hired under a fabricated or stolen identity, paid a salary remitted to the DPRK, and reaching a company laptop through a facilitator who keeps it powered on with remote access running.

In Contagious Interview the operator is the interviewer: a recruiter sends a developer a coding assignment whose dependencies install BeaverTail, InvisibleFerret or OtterCookie. The halves share personas, freelance platforms, GitHub histories and some infrastructure, so one tag covers both. Vendor names for it overlap rather than coincide.

Named individuals

101 profiled from law-enforcement records

Fabricated personas

438 reconstructed from reported accounts

Indicators

19,966 in the searchable index

Hunts

37 in the hunt library

How it differs from the other clusters here

Access is granted rather than taken: no exploit, phishing or access broker, only a job offer, onboarding and a laptop couriered to a given address.

The operator holds legitimate credentials, an approved device and a reason to read source code, a position APT38 spends months reaching.

Persistence is employment, not implants; the longest-running risk is an insider with commit access, and reporting documents extortion using data taken during a contract.

Contagious Interview targets individual developers, reaching organisations through their credentials; malware repeatedly targets browser credential stores, wallet extensions and development tooling.

On-chain delivery, where a smart contract holds the loader stage, is tracked on the EtherHiding Tracker.

Compare Lazarus GroupAPT38KimsukyRGB (Reconnaissance General Bureau)AndarielAPT37KonniMoonstone SleetPolinRider

What a defender would see

Employment side: remote-access tools installed in the first days and never removed, or several on one machine.

Also an IP-KVM device, a VS Code dev tunnel, an RDP or VNC listener, or anti-idle utilities on an employee endpoint.

At the network edge: commercial VPN egress (Astrill recurs) and one address serving several unconnected employees, which is what a laptop farm looks like.

Identity signals appear first: a camera that stays off or composited video, and an address or phone number shared across applicants.

A shallow, quickly built portfolio and GitHub history, or a payroll redirect request soon after onboarding.

The hunt library has a query for each, with telemetry and false positives.

Interview side: a repo cloned from a recruiter's link, a package install, then an outbound Node or Python connection to an unseen host.

Every person below is named in a public charging document, sanctions record or law-enforcement wanted notice that carries this cluster tag. Each profile lists the records it draws on and nothing beyond them.

• No photographAlexander Paul Travis
• No photographAn Kwang Il안광일
• No photographAudricus Phagnasay
• Chang Nam Il장남일
• Cho Chung Pom조충범
• Choe Jong Yong최정용
• Choe Song Ryong최성룡
• Christina Marie Chapman
• No photographDo Phi Khanh
• No photographEmanuel Ashtor
• No photographErick Ntekereze Prince
• No photographGayk Asatryan
• No photographHan Guo Bin
• No photographHan Il Nam한일남
• No photographHo Jong Son허정선
• No photographHoang Minh Quang
• No photographHoang Van Nguyen
• Huang Jingbin
• No photographHwang Chol황철
• Hyon Chol Song현철성
• Jang Chol Myong장철명
• No photographJang Kuk Chol장국철
• No photographJason Salazar
• No photographJin Long
• Jin Sung-Il진성일
• No photographJo Kyong Hun조경훈
• No photographJon Yon Gun전연근
• No photographJong In Chol정인철
• Jong Kyong Chol정경철
• Jong Pong Ju정봉주
• Jong Song Hwa정성화
• No photographJuan Cecilio Pena Carrillo
• No photographKang Hyon Chol강현철
• Kang Kil Nam강길남
• Kang Tae Bok강태복
• No photographKejia Wang
• No photographKim Chol Min김철민
• No photographKim Hyo Dong김효동
• No photographKim Ki Hyok김기혁
• Kim Kum Song김금성
• Kim Kwang Jin김광진
• No photographKim Kyong Il김경일
• Kim Mu Rim김무림
• Kim Ryu Song김류성
• No photographKim Sang Man김상만
• Kim Se Un김세운
• No photographKim Song Il김성일
• No photographKim Ung Sun김응순
• Kim Won Jin김원진
• Kim Ye Won김예원

Identities assembled from the accounts, addresses and portfolio sites reported under one name. A persona is a reporting artefact rather than a person: several may be run by one operator, and one may be run by several.

• 2401
• Adam Lee
• Aiden Mori
• Alerdi Jane
• Alex Hong
• Alex Wang

• TTP Hunt high IP-KVM Hardware on a Corporate Laptop and on Its Network Segment USB and PnP telemetry for the KVM-over-IP and video-capture hardware DPRK operators attach to employer-issued laptops, paired with the network view of the same devices: Raspberry Pi hardware addresses, the default TinyPilot host name and internet-exposed KVM interfaces. WindowsmacOSNetwork Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Shodan / Censys · Sigma · Splunk SPL · osquery
• TTP Hunt high IP-KVM Hardware Hiding Behind Spoofed USB Descriptors Catches an IP-KVM whose vendor, product and serial strings have been renamed to something innocuous, using the USB configuration descriptor and interface shape the device cannot change without ceasing to work. WindowsmacOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• TTP Hunt medium GL.iNet Comet IP-KVM Behind Its Built-In Obfuscation Profiles Fingerprints for the GL.iNet Comet, an IP-KVM whose firmware ships with ready-made presets that impersonate a Logitech, Corsair, Dell or Microsoft peripheral, and for the configuration descriptor, display identity and hardware address those presets leave untouched. WindowsmacOSNetwork Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• TTP Hunt medium Unmanaged Remote-Access and RMM Tooling on Employee Endpoints A fleet-wide sweep for the consumer remote-access and RMM software DPRK IT workers install to hand control of an employer-issued laptop to an operator overseas, with a per-device product count that flags the hosts running four or more of them. WindowsmacOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · YARA · osquery
• TTP Hunt medium Visual Studio Code Dev Tunnels Used as Remote Access A developer laptop can be handed to a remote operator with no third-party software at all, using the tunnelling feature built into Visual Studio Code. ReliaQuest ranks it among the tools North Korean operators use most. WindowsmacOSNetwork Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• TTP Hunt medium Inbound RDP and VNC Listeners on an Employee Endpoint A laptop-farm machine has to accept inbound connections. This looks for an endpoint listening on, or accepting traffic on, remote-desktop and remote-access ports, adapting the port checks published by mattysplo.it. WindowsmacOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• IOC Hunt medium Astrill VPN Egress on Corporate Authentication Astrill VPN is the anonymisation service most consistently associated with DPRK remote-worker fraud. This matches corporate sign-ins against its published exit addresses. Identity / cloudWindowsmacOS CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• IOC Hunt medium Egress from ISPs and Proxy Services Reported in DPRK Worker Cases The addresses operators appear on when the VPN is not in the way: Russian TTK ranges around Khabarovsk, China Unicom, and the commercial proxy and hosting services named in recent casework. Identity / cloudNetwork Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Splunk SPL
• Behavioral Hunt medium Unrelated Employees Authenticating from One Fixed-Line Address The signature of a laptop farm seen from the identity side: two or more employees who have nothing to do with each other, signing in from the same residential address. Identity / cloud CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Splunk SPL
• Behavioral Hunt medium Laptop Shipping Address and Sign-In Geography Against the Record Joins HR, asset-shipping and identity-provider data to find new hires whose laptop shipped away from their recorded address, or whose first month of sign-ins geolocates away from it, the control Mandiant and the FBI single out. Identity / cloud Defender / Sentinel KQL · Splunk SPL
• Behavioral Hunt medium Concurrent Multi-Geography Sessions on One Identity Impossible-travel and overlapping-session logic aimed at the specific case where a laptop physically sits in one country while the person operating it is in another. Identity / cloud CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Splunk SPL
• IOC Hunt medium VDO.Ninja (OBS.Ninja) Screen Relay and Interview-Support Web Services Browser artifacts of the screen-relay and audio/video test services Huntress recovered from a suspected DPRK worker's laptop, including the vdo.ninja push URL used to stream the host's screen out. WindowsmacOSNetwork Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL
• TTP Hunt low Virtual Cameras and Video-Call Obfuscation Tooling Software and hardware that lets an arbitrary video feed be presented to Zoom or Teams as a webcam, including real-time face-swap tooling, which is how an operator attends a call as somebody else. WindowsmacOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• TTP Hunt low Anti-Idle and Mouse-Jiggling Tooling on Employee Endpoints Software that keeps a machine awake and an account showing as present, which is what an operator running several jobs at once needs on every laptop they are not currently at. WindowsmacOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• TTP Hunt high SASE and Endpoint Agent Tampering by an Employee Disabling the SASE or endpoint agent is how an operator gets their own traffic out from under inspection. DTEX rates it low-recall but high-precision: it does not happen often, and when it does it means something. WindowsmacOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL
• Behavioral Hunt medium Working-Hour and Session-Length Anomalies for Recent Hires Sustained sign-ins at times that make no sense for where the employee says they live, which is how an operator working several jobs round the clock shows in the identity logs. Excessive working hours is among the highest-rated indicators in DTEX's own casework. Identity / cloud CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Splunk SPL
• Behavioral Hunt low Plaintext Credential Notes on Employee Endpoints Text files full of passwords in the obvious folders, which DTEX records in DPRK IT-worker casework as an operator's way of keeping credentials for several employers within reach. WindowsmacOS Cortex XQL · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• Behavioral Hunt low Company Source Code Pushed to Personal Repositories from an Employee Endpoint Git pushes, remote changes and mirror clones aimed at accounts outside the organisation on public hosting services: the precursor to the data-extortion the FBI now attributes to discovered DPRK IT workers. WindowsmacOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL
• IOC Hunt low Fabricated Candidate Personas and Portfolio-Site Infrastructure A recruiting-side hunt: the free site builders that host fabricated candidate portfolios, the identity-reuse patterns across applications, and the profile tells that repeat across personas. WindowsmacOSNetwork Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL
• Behavioral Hunt low Identity Reuse and Payroll-Fraud Indicators Shared bank details across employees who should have nothing in common, plus rapid post-hire direct-deposit changes, corroborated against sign-in geography. Identity / cloud Defender / Sentinel KQL · Splunk SPL
• IOC Hunt low Account-Verification and Browser OTP Services on Corporate Assets The services an operation uses to phone-verify accounts in bulk, hold VoIP numbers for personas, and generate multi-factor codes in a browser so a whole team can share one second factor. WindowsmacOSNetwork Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL
• TTP Hunt medium Persona-Management Tooling on an Employee Endpoint The tools an operation uses to keep many personas apart and to pass identity checks without a real phone or camera, anti-detect browsers, Android emulators and cookie-import tools among them, found on a machine that belongs to one supposed employee. WindowsmacOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• TTP Hunt medium Contagious Interview Fake-Recruiter and Front-Company Infrastructure Catches the interview lure itself: a candidate's workstation cloning and running an unvetted take-home repository, and traffic toward the front companies DPRK operators register to look like employers. WindowsmacOSNetwork Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL
• TTP Hunt medium ClickFake Interview: ClickFix Execution and GolangGhost Persistence Site The lure where a fake interview site claims the candidate's camera driver is broken and has them paste a command into Run or Terminal, delivering GolangGhost or FrostyFerret. WindowsmacOSNetwork Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• TTP Hunt medium macOS Persistence and Staging Paths Used by Contagious Interview Payloads The launch agents, /var/tmp staging files, fake installer packages and abused developer signature that Contagious Interview's macOS payloads leave on a developer's Mac, from the FlexibleFerret, GolangGhost and BeaverTail installer lures. macOSNetwork Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• TTP Hunt high BeaverTail to InvisibleFerret: The Contagious Interview Malware Chain The JavaScript stealer Contagious Interview delivers and the Python backdoor it installs, hunted as one chain: hidden .pyp, .npl and .n2 paths, the /pdown C2 layout, ports 1224, 3000 and 3306, silent AnyDesk and Telegram exfiltration. WindowsmacOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · YARA · osquery
• IOC Hunt medium Fake MiroTalk Installer in a Recruiter Lure: Qt BeaverTail A MiroTalk.msi or MiroTalk.dmg installer a job candidate is asked to run for a video interview, carrying the Qt-compiled BeaverTail Unit 42 documents, followed by the downloader fetching Python and InvisibleFerret from its controller on TCP 1224. WindowsmacOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• TTP Hunt medium EtherHiding: JADESNOW Loader Pulling Payloads from Public Blockchains A script interpreter on a developer's machine reading blockchain explorer APIs to pull a smart-contract payload, then beaconing on TCP 3306: the on-chain loader Google Threat Intelligence Group attributes to UNC5342, the group behind Contagious Interview. WindowsmacOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · YARA · osquery
• TTP Hunt low EtherHiding: Fake Google Drive Offline Extension Configured On-Chain A Chrome extension named Google Drive Offline, added silently by a Node.js backdoor after a fake macOS update lure and configured from an Ethereum contract; the chain AllSecure links to UNC5342, as reported by Cyber Security News. macOS Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · YARA · osquery
• TTP Hunt medium OtterCookie Modular JavaScript Implant Command-and-control addresses, URI paths and on-disk keylog and screenshot artifacts for the four-module OtterCookie implant Talos analysed alongside BeaverTail. WindowsmacOSLinux Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• TTP Hunt medium DeceptiveDevelopment Second-Stage Tooling: TsunamiKit, Tropidoor and AkdoorTea The .NET spyware-and-miner kit, the two Windows RATs and the infrastructure ESET documents behind the BeaverTail and InvisibleFerret first stages, including a Tor command channel, coin miners and Defender exclusions. WindowsmacOSLinux Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · YARA · osquery
• TTP Hunt medium Suspicious Package Install During an Interview Take-Home Assignment npm, node, pip or python spawning a shell, downloader or the other interpreter just after an install, and the interpreter reaching a staging host minutes later, whether the payload runs in a child process or entirely in memory. WindowsmacOSLinux Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• TTP Hunt medium PolinRider: Config-File Injection and Git History Rewrite A build-tool config file such as postcss.config.mjs growing an obfuscated tail, a .vscode/tasks.json that runs on folder open, and scripts that amend and force-push the last commit under its original timestamp: the PolinRider campaign. WindowsmacOSLinux Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · YARA · osquery
• TTP Hunt medium NullReceiver: C2 Address Read from a Zero-Value Ethereum Transfer A node process calling public Ethereum JSON-RPC endpoints to read an attacker wallet's latest transfer, whose recipient address encodes the next command server, then connecting to it: the NullReceiver technique OpenSourceMalware and Sonatype document. WindowsmacOSLinux Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · YARA · osquery
• IOC Hunt medium NetKey and OConnect: DPRK Internal-Network Clients on an Endpoint Process names, install paths and vendor directories for NetKey and OConnect, which Flare assesses are used to authenticate to North Korean internal networks, with the internal URL paths that accompany them. Windows Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · osquery
• IOC Hunt medium logs-bin and logs-dump: Republished Keylogger Packages on npm Two npm packages published by one maintainer that republish the node-global-key-listener library under new names, one of them carrying a Windows binary thirty-two times the size of the legitimate one it replaces. WindowsmacOSLinux Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Sigma · Splunk SPL · YARA · osquery
• IOC Hunt medium OtterCookie C2 by Its Three-Port Fingerprint The current OtterCookie variant splits its traffic across three ports on one host, 8085, 8086 and 8087, behind an Express server, which makes its command-and-control servers findable in internet scan data before any sample points at them. WindowsmacOSLinuxNetwork Cortex XQL · CrowdStrike LogScale · Defender / Sentinel KQL · Elastic · Shodan / Censys · Sigma · Splunk SPL · osquery

Indicators

The 19,966 indicators the index holds under this cluster. The complete index is on Remote Workers.

Show more results

Where the evidence comes from