UNC2970
2023-03-09 • Mandiant • Stealing the LIGHTSHOW (Part One) — North Korea's…
UNC2970 is Mandiant’s designation for a suspected North Korean espionage actor assessed with high confidence to overlap UNC577, also known as TEMP.Hermit. Mandiant began tracking the cluster in June 2022 after intrusions against Western technology and media companies, including suspected targeting of security researchers. The actor uses Operation Dream Job-style recruitment lures, polished fake recruiter profiles on LinkedIn, and extended conversations over WhatsApp before delivering tailored job descriptions or skills tests. Payloads have included malicious Word templates, ISO files, trojanized TightVNC software, and custom families such as LIDSHIFT, LIDSHOT, PLANKWALK, TOUCHSHIFT, TOUCHKEY, TOUCHSHOT, and HOOKSHOT. UNC2970 compromises legitimate WordPress sites for command-and-control, performs system reconnaissance, steals keystrokes and screenshots, tunnels traffic, and deploys layered in-memory payloads. Its campaigns show careful target research and persistent social engagement designed to penetrate strategically valuable organizations in the United States and Europe.
-
60
Related Actors
-
690
Related Reports