image credit: Freepik

North Korean UNC2970 Hackers Expands Operations with New Malware Families

March 10, 2023

Google-owned Mandiant said the threat cluster shares “multiple overlaps” with a long-running operation dubbed “Dream Job” that employs job recruitment lures in email messages to trigger the infection sequence.

UNC2970 is the new moniker designated by the threat intelligence firm to a set of North Korean cyber activity that maps to UNC577 (aka Temp.Hermit), and which also comprises another nascent threat cluster tracked as UNC4034.

The UNC4034 activity, as documented by Mandiant in September 2022, entailed the use of WhatsApp to socially engineer targets into downloading a backdoor called AIRDRY.V2 under the pretext of sharing a skills assessment test.

Read More on The Hacker News