UNC577
2023-03-09 • Mandiant • Stealing the LIGHTSHOW (Part One) — North Korea's…
Mandiant tracks UNC577, also known as Temp.Hermit, as a cluster of North Korean cyber activity active since at least 2013 that has significant malware overlaps with other North Korean operators, with whom it is believed to share resources such as code and complete malware tools. While UNC577 activity has primarily targeted entities in South Korea, it has also targeted organizations worldwide. Mandiant assessed with high confidence that a separately tracked cluster, UNC2970, is in fact UNC577, noting that UNC2970 has conducted a job-recruitment-themed spear-phishing campaign against Western media and technology companies since June 2022 that overlaps with prior public reporting on "Operation Dream Job." This activity included social engineering targets on LinkedIn using fake recruiter accounts before shifting conversations to WhatsApp to deliver phishing payloads, and deployment of the PLANKWALK backdoor alongside other post-exploitation tooling that shares code with tools previously attributed to UNC577, illustrating the group's evolution from a South Korea-focused cluster into an actor with global reach against media and technology targets.
-
60
Related Actors
-
690
Related Reports