Fake job / recruiter lure

Fake recruiter delivers a trojanised "assessment" file

Example: Contagious Interview (DPRK)

Classification

30 values: 15 imported, 1 derived, 14 machine-classified. What do these mean?

Exploitability

Impact & scope

Detection & telemetry

Detection & response

Mitigated by 26

• M1017 attack-mitigation
• M1018 attack-mitigation
• M1021 attack-mitigation
• M1038 attack-mitigation
• M1040 attack-mitigation
• M1047 attack-mitigation
• M1049 attack-mitigation
• D3-CF d3fend
• D3-CM d3fend
• D3-CQ d3fend
• D3-DA d3fend
• D3-DF d3fend
• D3-EAL d3fend
• D3-EDL d3fend
• D3-EFA d3fend
• D3-FA d3fend
• D3-FE d3fend
• D3-FEV d3fend
• D3-FIM d3fend
• D3-HD d3fend
• D3-IAA d3fend
• D3-LFP d3fend
• D3-RF d3fend
• D3-RFAM d3fend
• D3-UA d3fend
• D3-URA d3fend

Detected by 41

• DET0115 attack-detection-strategy
• DET0294 attack-detection-strategy
• 00d0b5ab-1f55-4120-8e83-487c0a7baf19 sigma
• 1193d960-2369-499f-a158-7b50a31df682 sigma
• 1337afba-d17d-4d23-bd55-29b927603b30 sigma
• 208748f7-881d-47ac-a29c-07ea84bf691d sigma
• 28208707-fe31-437f-9a7f-4b1108b94d2e sigma
• 289dfa9e-e378-4a56-a9d4-7ed5ee218029 sigma
• 29fd07fc-9cfd-4331-b7fd-cc18dfa21052 sigma
• 3c6f5e4a-8d0b-6abc-d9e2-4f7a6b8c9d0e sigma
• 401e5d00-b944-11ea-8f9a-00163ecd60ae sigma
• 438025f9-5856-4663-83f7-52f878a70a50 sigma
• 4922a5dd-6743-4fc2-8e81-144374280997 sigma
• 557e3bd3-7f21-495d-8d50-7c8bdfb8041c sigma
• 60936b49-fca0-4f32-993d-7415edcf9a5d sigma
• 678eb5f4-8597-4be6-8be7-905e4234b53a sigma
• 69483748-1525-4a6c-95ca-90dc8d431b68 sigma
• 7bdde3bf-2a42-4c39-aa31-a92b3e17afac sigma
• 864403a1-36c9-40a2-a982-4c9a45f7d833 sigma
• 8a582fe2-0882-4b89-a82a-da6b2dc32937 sigma
• 90217a70-13fc-48e4-b3db-0d836c5824ac sigma
• 932ac737-33ca-4afd-9869-0d48b391fcc9 sigma
• 9a025188-6f2d-42f8-bb2f-d3a83d24a5af sigma
• 9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed sigma
• 9b4f3d2e-6e8c-5fab-c7d9-2a3b4e5f6a7b sigma
• 9cfe4b27-1e56-48b4-b7a8-d46851c91a44 sigma
• a7e6b1f9-8d2c-4f1e-9a7d-63e4c8a2bf4c sigma
• aa3a6f94-890e-4e22-b634-ffdfd54792cc sigma
• af4c4609-5755-42fe-8075-4effb49f5d44 sigma
• af5732ed-764e-489d-826d-0447c8b36242 sigma
• b5de2919-b74a-4805-91a7-5049accbaefe sigma
• c5f4b5cb-4c25-4249-ba91-aa03626e3185 sigma
• c7a74c80-ba5a-486e-9974-ab9e682bc5e4 sigma
• d13c43f0-f66b-4279-8b2c-5912077c1780 sigma
• dd8756e7-a3a0-4768-b47e-8f545d1a751c sigma
• e1693bc8-7168-4eab-8718-cdcaa68a1738 sigma
• e54279c7-4910-4e2c-902c-c56a25b549f6 sigma
• e6ce8457-68b1-485b-9bdd-3c2b5d679aa9 sigma
• f40017b3-cb2e-4335-ab5d-3babf679c1de sigma
• fdd84c68-a1f6-47c9-9477-920584f94905 sigma
• … and 1 more in the database

Tested by 13

• 02f35d62-9fdc-4a97-b899-a5d9a876d295 atomic
• 0330a5d2-a45a-4272-a9ee-e364411c4b18 atomic
• 22386853-f68d-4b50-a362-de235127c443 atomic
• 24fd9719-7419-42dd-bce6-ab3463110b3c atomic
• 3f3120f0-7e50-4be2-88ae-54c61230cb9f atomic
• 3f3af983-118a-4fa1-85d3-ba4daa739d80 atomic
• 4ea1fc97-8a46-4b4e-ba48-af43d2a98052 atomic
• 5202ee05-c420-4148-bf5e-fd7f7d24850c atomic
• 581d7521-9c4b-420e-9695-2aec5241167f atomic
• 8bebc690-18c7-4549-bc98-210f7019efff atomic
• 9215ea92-1ded-41b7-9cd6-79f9a78397aa atomic
• a19ee671-ed98-4e9d-b19c-d1954a51585a atomic
• add560ef-20d6-4011-a937-2c340f930911 atomic

Attack relationships

• Parent: Baiting
• Parent: BEC: data theft (W-2/PII)
• Parent: Device-code phishing
• Parent: Phishing
• Parent: Whaling

Framework references

• Primary source: https://attack.mitre.org/techniques/T1566/003/
• attack: T1566.003 (primary)
• attack: T1204.002

Evidence & sources

• ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Social engineering and human-targeted attacks' table, line 52 of Cyber-Attack-Taxonomy.md
• ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1566.003, attack:T1204.002 as the nearest framework entries; ids verified to exist in the cached catalogues.
• ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 16 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
• ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 196 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)