A North Korean espionage group tracked as
UNC2970 has been observed employing previously undocumented malware families as part of a spear-phishing campaign targeting U.S. and European media and technology organizations since June 2022.
Google-owned Mandiant said the threat cluster shares "multiple overlaps" with a
long-running operation dubbed "
Dream Job" that employs job recruitment lures in email messages to trigger the infection sequence.
UNC2970 is the new moniker designated by the threat intelligence firm to a set of North Korean cyber activity that maps to UNC577 (aka
Temp.Hermit), and which also comprises another nascent threat cluster tracked as UNC4034.
The UNC4034 activity, as
documented by Mandiant in September 2022, entailed the use of WhatsApp to socially engineer targets into downloading a
backdoor called AIRDRY.V2 under the pretext of sharing a skills assessment test.
"UNC2970 has a concerted effort towards obfuscation and employs multiple methods to do this throughout the entire chain of delivery and execution," Mandiant researchers said in a
detailed two-part analysis, adding the effort specifically targeted security researchers.
thehackernews.com
