EuRepoC
The North Korean state-sponsored hacking group UNC2970 gained access to a multinational energy company in June 2024 · 01.06.2024
The North Korean state-sponsored hacking group UNC2970 gained access to a multinational energy company in June 2024, Google reported in a technical report on 17 September 2024. The hacking group posed as a recruiter for well-known companies and lured an unspecified victim via WhatsApp with a job offer. The job offer was in an encrypted PDF file that the victim could only open with the help of a trojanised version of the SumatraPDF software, which downloaded the MISTPEN backdoor via the BURNBOOK uploader. The specific victim downloaded such a ZIP archive, and the connection to the backdoor was then made via a SharePoint server at an unnamed university.