lazarusholic

Everyday is lazarus.dayβ

UNC2970

2023-03-09, Mandiant
Stealing the LIGHTSHOW (Part One) — North Korea's UNC2970

Also known as

 
Name Named by AKA First seen Last seen
TEMP.Hermit Fireeye BlueNoroff 2017-09-13 2025-05-14
UNC1758 Mandiant TEMP.Hermit 2023-04-18 2023-04-18
UNC2970 Mandiant TEMP.Hermit 2023-03-09 2026-02-13
UNC4034 Mandiant TEMP.Hermit 2022-09-14 2022-11-03
UNC577 Mandiant TEMP.Hermit 2023-03-09 2023-03-09
UNC785 Mandiant TEMP.Hermit 2023-03-28 2023-03-28
UNC786 Mandiant TEMP.Hermit 2023-03-28 2023-03-28

Reports

2026-02-13
Google
GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use
#UNC2970
2025-11-20
OrangeCyberdefense
A Pain in the Mist: Navigating Operation DreamJob’s arsenal
#DreamJob #MISTPEN #UNC2970
2024-09-19
Foresiet
North Korea’s MistPen Malware Threatens Energy & Aerospace Sectors
#MISTPEN #UNC2970
2024-09-17
Mandiant
An Offer You Can Refuse: UNC2970 Backdoor Deployment Using Trojanized PDF Reader
#BURNBOOK #MISTPEN #UNC2970
2023-03-09
Mandiant
Stealing the LIGHTSHOW (Part One) — North Korea's UNC2970
#LIGHTSHOW #UNC2970 #YARA #BYOVD #UNC577
2023-03-09
Mandiant
Stealing the LIGHTSHOW (Part Two) — LIGHTSHIFT and LIGHTSHOW
#YARA #BYOVD #UNC2970 #LIGHTSHIFT #LIGHTSHOW