From 0d8e535b88235b982d411af685cd8be0870ed7cd Mon Sep 17 00:00:00 2001 From: Mathieu4141 Date: Mon, 9 Sep 2024 08:18:22 -0700 Subject: [PATCH] [threat-actors] Add UNC2970 --- clusters/threat-actor.json | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 1b42415..7842eb3 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -16558,6 +16558,17 @@ }, "uuid": "c54b9a98-1436-4e29-b194-e5bde003dd4d", "value": "ZeroSevenGroup" + }, + { + "description": "UNC2970 is a North Korean threat actor that primarily targets organizations through spear-phishing emails with job recruitment themes, often utilizing fake LinkedIn accounts to engage victims. The group employs the PLANKWALK backdoor and other malware families, leveraging compromised WordPress sites for command and control. They have been observed using BYOVD techniques to exploit vulnerable drivers for evading detection. Mandiant has noted a shift in UNC2970's targeting strategy, including a focus on security researchers and advancements in their operational capabilities against EDR tools.", + "meta": { + "country": "KP", + "refs": [ + "https://www.mandiant.com/resources/blog/lightshow-north-korea-unc2970" + ] + }, + "uuid": "e40cf515-f155-46d4-b174-88b38383f9bb", + "value": "UNC2970" } ], "version": 313