Organizations in the energy and aerospace verticals · 17/09/2024
Researchers at Mandiant discover UNC2970, a North Korea-linked cyber-espionage group leveraging job-themed phishing lures to target prospective victims in energy and aerospace verticals and infect them with a previously undocumented backdoor dubbed MISTPEN. [Date Occurred: Since at least June 2024; Date Discovered: During June 2024]
UNC2970 trojanized SumatraPDF job lures (MISTPEN via BURNBOOK) against energy and aerospace · 2024-09-17 (datePublished)
In June 2024, Mandiant Managed Defense identified a cyber espionage group suspected to have a North Korea nexus, tracked by Mandiant under UNC2970. Later that month, Mandiant discovered additional phishing lures masquerading as an energy company and as an entity in the aerospace industry to target victims in these verticals. ... UNC2970 relies on legitimate job description content to target victims employed in U.S. critical infrastructure verticals.