Threat Briefing 51: Contagious Interview: Exploiting Recruitment and Development Workflows and the Implications for Aerospace and Defense

Overview

On 18 September 2026, a joint security advisory from government agencies in Japan, the United States, Australia and Germany detailed activity associated with North Korean cyber actor WaterPlum and the “Contagious Interview” campaign. The advisory highlighted significant overlap between WaterPlum and DPRK IT worker threat activity, with operators targeting software developers and IT professionals through fraudulent recruitment opportunities and exploitation of routine hiring processes to deliver malicious software and steal sensitive information.

According to the advisory, activity linked to WaterPlum has affected at least 30,000 devices across more than 100 countries, underscoring the extensive reach of the campaign. These findings further demonstrate how threat actors continue to exploit professional networking and trusted software development workflows to compromise technical personnel.

“Contagious Interview” presents a relevant threat to aerospace and defense organizations, particularly those relying on employees and external contractors working within sensitive development environments. Reporting from Recorded Future identified the use of fraudulent LinkedIn personas, fake organizations and malicious GitHub repositories to distribute malware to prospective job applicants. The investigation identified 3,136 IP addresses linked to potential targets and 20 potential victim organizations spanning several industries. Researchers also observed instances in which candidates likely executed malicious code on corporate devices, potentially exposing their employers and downstream customers to further compromise.

Contagious Interview Social Engineering and Technical Tradecraft

The “Contagious Interview” campaign relies on recruitment-based social engineering, with operators impersonating prospective employers and recruiters to target individuals through professional networking platforms and job boards. Victims are presented with seemingly legitimate interviews or technical assessments requiring them to download and execute malicious code. In some observed activity, attackers instructed applicants to troubleshoot fabricated video conferencing errors, resulting in malicious code execution. These techniques demonstrate how operators continue to exploit the credibility of routine hiring processes, turning legitimate recruitment activities into opportunities for initial access.

Upon execution, the campaign leverages multiple malware families to collect sensitive information and establish persistent access to compromised systems. Observed payloads include BeaverTail, OtterCookie, StoatWaffle and OtterCandy, with capabilities spanning information theft, malware loading and remote access. Additional observed functionality includes file collection, command execution, credential theft and exfiltration through attacker-controlled infrastructure. The use of malicious coding assignments and recruitment-related materials to facilitate multi-stage malware delivery further demonstrates the risks associated with executing untrusted code within technical and development environments.

Implications for Aerospace and Defense

WaterPlum’s evolving tradecraft presents a relevant risk to aerospace and defense industrial base (DIB) organizations through its targeting of software developers and technical professionals using fraudulent recruitment opportunities, fake personas and malicious coding assignments. Although “Contagious Interview” has primarily targeted individuals within cryptocurrency, Web3 and software development, these techniques carry potential implications for aerospace and defense organizations that rely on specialized developers, external contractors and shared development environments. Successful compromises could expose sensitive intellectual property, credentials and development infrastructure, creating potential downstream impacts beyond the initially targeted individual.

Historically, North Korean cyber operations have demonstrated sustained interest in aerospace and defense technologies. In 2020, a recruitment-based espionage campaign impersonated prominent U.S. aerospace and defense companies to target defense-sector personnel. This activity continued in subsequent years, with reporting indicating that Moonstone Sleet compromised a defense technology company in December 2023, stealing credentials and intellectual property. The same organization was later targeted with ransomware in April 2024, alongside separate compromises involving a drone technology company and an aircraft-parts manufacturer. Additional activity was observed in a 2024 campaign involving UNC2970, which targeted aerospace and energy organizations through fraudulent recruitment opportunities and malicious job descriptions used to deliver the MISTPEN backdoor.

While these incidents are distinct from “Contagious Interview,” they demonstrate the continued use of recruitment-based deception, malicious software and credential theft to compromise technical personnel across strategically significant industries. For aerospace and defense organizations, these operations highlight potential exposure through developer workstations, third-party relationships and interconnected software supply chains. The combination of historically documented sector targeting and the evolving techniques of “Contagious Interview” reinforces the growing importance of securing recruitment processes and development environments supporting sensitive technologies.

Conclusion

“Contagious Interview” reflects a broader pattern of cyber operations exploiting professional networking, remote hiring practices and trusted development workflows to gain unauthorized access to technical environments. The campaign’s continued use of fraudulent recruitment opportunities and multi-stage malware delivery demonstrates how individual compromises can create broader organizational exposure. For aerospace and defense organizations, these developments underscore the importance of securing developer workstations, evaluating third-party access and scrutinizing unfamiliar code introduced through recruitment processes.

As threat actors continue to exploit legitimate professional interactions, “Contagious Interview” remains a relevant threat model for understanding how the compromise of technical personnel can potentially expose sensitive information and interconnected development environments.