Contagious Interview

☆ pin

MITRE G0133Also known as Famous Chollima, FAMOUS CHOLLIMA, Void Dokkaebi, WageMole, REF9403, UNC5342, HexagonalRodent, Fake Font, Lazarus

Reports

First seen

Oct 1, 2025

Last seen

Oct 14, 2026

Motivation

Espionage, Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Technology ×6 Other ×3 Financial Services ×1

Victim regions

×4

United States×4

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1041 Exfiltration Over C2 Channel ×13T1566 Phishing ×12T1219 Remote Access Software ×9T1195 Supply Chain Compromise ×9T1027 Obfuscated Files or Information ×6T1204 User Execution ×6T1005 Data from Local System ×6T1003 OS Credential Dumping ×5T1555 Credentials from Password Stores ×5T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools ×5T1110 Brute Force ×4T1190 Exploit Public-Facing Application ×4

Indicators

filename ×25domain ×21cve ×18ip_v4 ×12email ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2025-20333 (exploited)CVE-2025-20352 (exploited)CVE-2025-20362 (exploited)CVE-2025-43300 (exploited)CVE-2025-53690 (exploited)CVE-2025-55177 (exploited)CVE-2025-55182 (exploited)CVE-2025-55241 CVE-2025-59528 (exploited)CVE-2025-64155 CVE-2025-8088 (exploited)CVE-2026-1281 (exploited)CVE-2026-20045 (exploited)CVE-2026-21509 (exploited)CVE-2026-31431 (exploited)CVE-2026-32201 (exploited)CVE-2026-35616 (exploited)CVE-2026-49494

Recent reports

High

ThreatsDay Bulletin: Weekly threat roundup covering infostealers, supply chain attacks, AI security risks, and endpoint defense evasion

The Hacker NewsJun 11, 2026 High

Contagious Interview

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

FBI disrupts Famous Chollima DPRK IT worker scheme, arrests 16 suspects across US

U.S. Government Disrupts FAMOUS CHOLLIMA Laptop Farm Operation with CrowdStrike Assistance

AI Agent Security Depends on Software Supply Chain Controls, Not Model Safeguards

North Korean Threat Actors Distribute Go Malware via Malicious Terraform Providers and Packages

WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage

Identity Abuse Through Trusted Communication Channels

Researchers Expose North Korean IT Worker Operation via Fake Crypto Startup Honeypot

CrowdStrike 2026 Threat Hunting Report: Exploitation Window Closes as AI Use Accelerates

DPRK-Linked macOS Malvertising Campaign Uses Fake Updates to Deliver Crypto-Stealing Malware

North Korean Threat Actors Distribute OtterCookie Malware via Fake Coding Tests and SVG Steganography

North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign

Hijacked npm and Go Packages Deploy Python Infostealer via VS Code Tasks

North Korean Hackers Using Developer Tools to Deliver Malware

ThreatsDay Bulletin: Weekly threat roundup covering infostealers, supply chain attacks, AI security risks, and endpoint defense evasion

CrowdStrike 2026 Technology Threat Landscape Report: China's Ambitions Fuel Attacks

Void Dokkaebi Adopts Cython-Compiled InvisibleFerret Malware

CrowdStrike 2026 Financial Services Threat Landscape Report Overview

CERT-EU Cyber Brief April 2026 – Espionage, Supply-Chain Attacks, and Critical Infrastructure Threats

Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories

CERT-EU Cyber Brief January 2026 – Espionage, Ransomware, and Critical Vulnerabilities

CERT-EU Cyber Brief September 2025 – Multi-Sector Threats Across Europe