DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

UNC2970 job-recruitment phishing against Western media and technology companies (since June 2022)

Date (as written)
2023-03-09 (datePublished)
Year
2023
Country
U.S.-based; U.S. and European
Actors (as written)
UNC2970 (suspected UNC577 / Temp.Hermit)
Actor pages
UNC2970
Tags (as written)
media and technology; security researchers

Source entries (2)

Hackmageddon cyber attacks timelines (Paolo Passeri)

Western Media and Technology companies · 09/03/2023
Researchers from Mandiant expose a campaign targeting Western Media and Technology companies from a suspected North Korean espionage group tracked as UNC2970. [Date Occurred: Since June 2022; Date Discovered: Since June 2022]
https://www.hackmageddon.com/2023/04/03/1-15-march-2023-cyber-attacks-timeline/
https://arstechnica.com/information-technology/2023/03/security-researchers-are-again-in-the-crosshairs-of-north-korean-hackers/

Mandiant / Google Cloud Threat Intelligence blog

UNC2970 job-recruitment phishing against Western media and technology companies (since June 2022) · 2023-03-09 (datePublished)
Since June 2022, Mandiant has been tracking a campaign targeting Western Media and Technology companies from a suspected North Korean espionage group tracked as UNC2970. In June 2022, Mandiant Managed Defense detected and responded to an UNC2970 phishing campaign targeting a U.S.-based technology company. ... Following the identification of this campaign, Mandiant responded to multiple UNC2970 intrusions targeting U.S. and European Media organizations through spear-phishing that used a job recruitment theme.
https://cloud.google.com/blog/topics/threat-intelligence/lightshow-north-korea-unc2970/

Suggest a correction on GitHub