North Korean UNC2970 Hackers Expands Operations with New Malware Families

Mar
10,
2023Ravie
LakshmananCyber
Attack
/
Malware

A
North
Korean
espionage
group
tracked
as

UNC2970
has
been
observed
employing
previously
undocumented
malware
families
as
part
of
a
spear-phishing
campaign
targeting
U.S.
and
European
media
and
technology
organizations
since
June
2022.

Google-owned
Mandiant
said
the
threat
cluster
shares
“multiple
overlaps”
with
a

long-running

operation

dubbed
“Dream
Job”
that
employs
job
recruitment
lures
in
email
messages
to
trigger
the
infection
sequence.

UNC2970
is
the
new
moniker
designated
by
the
threat
intelligence
firm
to
a
set
of
North
Korean
cyber
activity
that
maps
to
UNC577
(aka

Temp.Hermit),
and
which
also
comprises
another
nascent
threat
cluster
tracked
as
UNC4034.

The
UNC4034
activity,
as

documented
by
Mandiant
in
September
2022,
entailed
the
use
of
WhatsApp
to
socially
engineer
targets
into
downloading
a

backdoor
called
AIRDRY.V2
under
the
pretext
of
sharing
a
skills
assessment
test.

“UNC2970
has
a
concerted
effort
towards
obfuscation
and
employs
multiple
methods
to
do
this
throughout
the
entire
chain
of
delivery
and
execution,”
Mandiant
researchers
said
in
a

detailed

two-part
analysis,
adding
the
effort
specifically
targeted
security
researchers.

Temp.Hermit
is
one
of
the
primary
hacking
units
associated
with
North
Korea’s
Reconnaissance
General
Bureau
(RGB)
alongside

Andariel
and

APT38
(aka
BlueNoroff).
All
three
actor
sets
are

collectively
referred
to
as
the

Lazarus
Group
(aka
Hidden
Cobra
or
Zinc).

“TEMP.Hermit
is
an
actor
that
has
been
around
since
at
least
2013,”
Mandiant

noted
in
a
March
2022
report.
“Their
operations
since
that
time
are
representative
of
Pyongyang’s
efforts
to
collect
strategic
intelligence
to
benefit
North
Korean
interests.”

The
latest
set
of
UNC2970
attacks
are
characterized
by
initially
approaching
users
directly
on
LinkedIn
using
“well
designed
and
professionally
curated”
fake
accounts
posing
as
recruiters.

The
conversation
is
subsequently
shifted
to
WhatsApp,
after
which
a
phishing
payload
is
delivered
to
the
target
under
the
guise
of
a
job
description.

In
some
instances,
these
attack
chains
have
been
observed
to
deploy
trojanized
versions
of
TightVNC
(named
LIDSHIFT),
which
is
engineered
to
load
a
next-stage
payload
labeled
as
LIDSHOT
that’s
capable
of
downloading
and
executing
shellcode
from
a
remote
server.

Establishing
a
foothold
within
compromised
environments
is
achieved
by
means
of
a
C++-based
backdoor
known
as
PLANKWALK
that
then
paves
the
way
for
the
distribution
of
additional
tooling
such
as
–

• 
  TOUCHSHIFT
  –
  A
  malware
  dropper
  that
  loads
  follow-on
  malware
  ranging
  from
  keyloggers
  and
  screenshot
  utilities
  to
  full-featured
  backdoors
• 
  TOUCHSHOT
  –
  A
  software
  that’s
  configured
  to
  take
  a
  screenshot
  every
  three
  seconds
• 
  TOUCHKEY
  –
  A
  keylogger
  that
  captures
  keystrokes
  and
  clipboard
  data
• 
  HOOKSHOT
  –
  A
  tunneling
  tool
  that
  connects
  over
  TCP
  to
  communicate
  with
  the
  command-and-control
  (C2)
  server
• 
  TOUCHMOVE
  –
  A
  loader
  that’s
  designed
  to
  decrypt
  and
  execute
  a
  payload
  on
  the
  machine
• 
  SIDESHOW
  –
  A
  C/C++
  backdoor
  that
  runs
  arbitrary
  commands
  and
  communicates
  via
  HTTP
  POST
  requests
  with
  its
  C2
  server

UNC2970
is
also
said
to
have
leveraged
Microsoft
Intune,
an
endpoint
management
solution,
to
drop
a
bespoke
PowerShell
script
containing
a
Base64-encoded
payload
referred
to
as
CLOUDBURST,
a
C-based
backdoor
that
communicates
via
HTTP.

In
what’s
a
continuing
use
of
the
Bring
Your
Own
Vulnerable
Driver
(BYOVD)
technique
by
North
Korea-aligned
actors,
the
intrusions
further
employ
an
in-memory-only
dropper
called
LIGHTSHIFT
that
facilitates
the
distribution
of
another
piece
of
malware
codenamed
LIGHTSHOW.

The
utility,
besides
taking
steps
to
hinder
dynamic
and
static
analysis,
drops
a
legitimate
version
of
a
driver
with
known
vulnerabilities
to
perform
read
and
write
operations
to
kernel
memory
and
ultimately
disarm
security
software
installed
on
the
infected
host.

“The
identified
malware
tools
highlight
continued
malware
development
and
deployment
of
new
tools
by
UNC2970,”
Mandiant
said.
“Although
the
group
has
previously
targeted
defense,
media,
and
technology
industries,
the
targeting
of
security
researchers
suggests
a
shift
in
strategy
or
an
expansion
of
its
operations.”