2025-02-13
RecordedFuture
Inside the Scam: North Korea’s IT Worker Threat
#BeaverTail
#ITWorker
#InvisibleFerret
#OtterCookie
#PurpleBravo
#TAG-121
#TAG-120
PurpleBravo
"Beyond financial fraud, these IT workers have been linked to cyber espionage. Insikt Group tracks PurpleBravo (formerly Threat Activity Group 120 [TAG-120]), a North Korean-linked cluster that overlaps with the “Contagious Interview” campaign, which primarily targets software developers in the cryptocurrency industry."
- RecordedFuture, https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat
Also known as
| Name | Named by | AKA | First seen | Last seen |
|---|---|---|---|---|
| FamousChollima | CrowdStrike | - | 2024-08-07 | 2025-02-28 |
| NickelTapestry | SecureWorks | FamousChollima | 2024-10-16 | 2025-02-12 |
| PurpleBravo | RecordedFuture | FamousChollima | 2025-02-13 | 2025-02-13 |
| TAG-120 | RecordedFuture | PurpleBravo | 2025-02-13 | 2025-02-13 |
| TenaciousPungsan | Datadog | FamousChollima | 2024-10-24 | 2024-10-24 |
| UNC5267 | Mandiant | FamousChollima | 2024-09-23 | 2024-09-23 |
| VoidDokkaebi | TrendMicro | FamousChollima | 2025-04-23 | 2025-04-23 |