2026-01-21
RecordedFuture
PurpleBravo’s Targeting of the IT Software Supply Chain
#BeaverTail
#ClickFix
#ContagiousInterview
#GolangGhost
#PurpleBravo
#PylangGhost
PurpleBravo
"Beyond financial fraud, these IT workers have been linked to cyber espionage. Insikt Group tracks PurpleBravo (formerly Threat Activity Group 120 [TAG-120]), a North Korean-linked cluster that overlaps with the “Contagious Interview” campaign, which primarily targets software developers in the cryptocurrency industry."
- RecordedFuture, https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat
Also known as
| Name | Named by | AKA | First seen | Last seen |
|---|---|---|---|---|
| ContagiousInterview | PaloaltoNetworks | FamousChollima | 2024-10-09 | 2026-05-31 |
| ElusiveComet | SecurityAlliance | FamousChollima | 2025-03-24 | 2025-04-17 |
| FamousChollima | CrowdStrike | - | 2024-08-07 | 2026-05-31 |
| GwisinGang | DtexSystems | FamousChollima | 2025-05-14 | 2025-05-14 |
| HexagonalRodent | Expel | FamousChollima | 2026-04-23 | 2026-04-30 |
| JasperSleet | Microsoft | FamousChollima | 2025-06-30 | 2026-04-21 |
| NickelAlley | SecureWorks | PurpleBravo | 2026-03-23 | 2026-03-23 |
| NickelTapestry | SecureWorks | FamousChollima | 2024-10-16 | 2025-05-08 |
| PurpleBravo | RecordedFuture | FamousChollima | 2025-02-13 | 2026-01-21 |
| TAG-120 | RecordedFuture | PurpleBravo | 2025-02-13 | 2025-02-13 |
| TenaciousPungsan | Datadog | FamousChollima | 2024-10-24 | 2024-10-24 |
| UNC5267 | Mandiant | FamousChollima | 2024-09-23 | 2026-03-09 |
| UNC5342 | Mandiant | FamousChollima | 2025-04-24 | 2025-10-16 |
| VoidDokkaebi | TrendMicro | FamousChollima | 2025-04-23 | 2026-05-22 |
| WaterPlum | NTTSecurity | FamousChollima | 2025-05-08 | 2026-03-17 |