Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

Reddit NetSec

CVE Database V5

Reddit InfoSec News

AlienVault OTX General

SecurityWeek

SANS ISC Handlers Diary

Threatpost

Dark Reading

The Hacker News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

North Korean threat actors associated with the Contagious Interview campaign cluster are actively monitoring cyber threat intelligence platforms to detect infrastructure exposure and scout for new assets. They operate in coordinated teams, likely using Slack for real-time collaboration, and leverage multiple intelligence sources including Validin, VirusTotal, and Maltrail. Despite being aware of their infrastructure's detectability, they make only limited changes to reduce detection risk, focusing instead on rapidly deploying new infrastructure to sustain operations. The actors' effectiveness is evident in their engagement of over 230 victims between January and March 2025, primarily targeting individuals in the cryptocurrency industry. Their activities involve sophisticated social engineering tactics, including the ClickFix technique, to trick targets into executing malware.

The Contagious Interview campaign is an ongoing cyber espionage operation attributed to North Korean threat actors, specifically linked to the Lazarus group or its affiliates. These actors actively monitor cyber threat intelligence platforms such as Validin, VirusTotal, and Maltrail to identify exposed infrastructure and discover new assets for exploitation. They operate in coordinated teams, reportedly using Slack for real-time communication and collaboration, which enhances their operational agility. Despite awareness of their infrastructure's detectability, they prioritize rapid deployment of new infrastructure over extensive obfuscation or stealth, enabling sustained operations even when some assets are discovered and taken down. Between January and March 2025, they engaged over 230 victims, predominantly targeting individuals in the cryptocurrency sector, a high-value target group due to the financial assets involved and the sector's relative vulnerability to social engineering. Their attack methodology heavily relies on sophisticated social engineering techniques, including the ClickFix technique, which manipulates targets into executing malware payloads. The campaign leverages multiple MITRE ATT&CK techniques such as T1583 (Establish Accounts), T1589 (Gather Victim Identity Information), T1059 (Command and Scripting Interpreter), T1584 (Compromise Infrastructure), T1586 (Compromise Accounts), T1608 (Stage Capabilities), T1204 (User Execution), T1566 (Phishing), T1585 (Establish Accounts), T1588 (Obtain Capabilities), and T1587 (Develop Capabilities), indicating a comprehensive and multi-faceted approach to intrusion and persistence. The absence of known exploits in the wild suggests the campaign relies more on social engineering and infrastructure monitoring rather than zero-day vulnerabilities. Overall, this campaign exemplifies a persistent, resourceful threat actor leveraging cyber intelligence platforms to maintain operational tempo and target high-value sectors like cryptocurrency through social engineering and infrastructure agility.

Detailed information about Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms. Get real-time updates, techn

Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms - Live Threat Intelligence - Threat Radar | OffSeq.com

Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms

Title	Severity	Type	Source	Date

Threats Tagged 'job seeker targeting'

Filter Threats

Threats Tagged 'job seeker targeting'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility