North Korean state-sponsored hacking group UNC2970 targeted US and European media and technology companies since at least June 2022

EuRepoC

The North Korea-linked APT UNC2970 has launched phishing-based espionage campaigns against US and European media and technology companies since at least mid-2022, based on observations by Mandiant from June 2022. Mandiant, with high confidence, identified UNC2970 as UNC577, an activity cluster commonly associated with the Lazarus Group. Also known as Temp.Hermit, UNC577 has been active since at least 2013 and is suspected of sharing malware and tools with other North Korean threat actors. UNC2970 conducted its phishing campaign via fraudulent job offerings and has more recently utilised LinkedIn to approach victims. During one of the operations tracked by Mandiant targeting security researchers, UNC2970 deployed three new malware families (TOUCHMOVE, SIDESHOW, and TOUCHSHIFT).

ThaiCERT Threat Group Cards

Stealing the LIGHTSHOW https://www.mandiant.com/resources/blog/lightshow-north-korea-unc2970 https://www.mandiant.com/resources/blog/lightshift-and-lightshow

In June 2022, Mandiant Managed Defense detected and responded to an UNC2970 phishing campaign targeting a U.S.-based technology company.

Mandiant responded to multiple UNC2970 intrusions targeting U.S. and European Media organizations through spear-phishing that used a job recruitment theme