A North Korean threat actor tracked as UNC2970 has been using job-themed lures in an effort to deliver new malware to individuals working in critical infrastructure sectors, according to Google Cloud’s Mandiant.
The first time Mandiant detailed UNC2970’s activities and links to North Korea was in March 2023, after the cyberespionage group was observed attempting to deliver malware to security researchers.
The group has been around since at least June 2022 and it was initially observed targeting media and technology organizations in the United States and Europe with job recruitment-themed emails.
In a blog post published on Wednesday, Mandiant reported seeing UNC2970 targets in the US, UK, Netherlands, Cyprus, Germany, Sweden, Singapore, Hong Kong, and Australia.
According to Mandiant, recent attacks have targeted individuals in the aerospace and energy sectors in the United States. The hackers have continued to use job-themed messages to deliver malware to victims.
UNC2970 has been engaging with potential victims over email and WhatsApp, claiming to be a recruiter for major companies.
The victim receives a password-protected archive file apparently containing a PDF document with a job description. However, the PDF is encrypted and it can only be opened with a trojanized version of the Sumatra PDF free and open source document viewer, which is also provided alongside the document.
Mandiant pointed out that the attack does not leverage any Sumatra PDF vulnerability and the application has not been compromised. The hackers simply modified the application’s open source code so that it runs a dropper tracked by Mandiant as BurnBook when it’s executed.
BurnBook in turn deploys a loader tracked as TearPage, which deploys a new backdoor named MistPen. This is a lightweight backdoor designed to download and execute PE files on the compromised system.
As for the job descriptions used as a lure, the North Korean cyberspies have taken the text of real job postings and modified it to better align with the victim’s profile.
“The chosen job descriptions target senior-/manager-level employees. This suggests the threat actor aims to gain access to sensitive and confidential information that is typically restricted to higher-level employees,” Mandiant said.
Mandiant has not named the impersonated companies, but a screenshot of a fake job description shows that a BAE Systems job posting was used to target the aerospace industry. Another fake job description was for an unnamed multinational energy company.
Related: FBI: North Korea Aggressively Hacking Cryptocurrency Firms
Related: Microsoft Says North Korean Cryptocurrency Thieves Behind Chrome Zero-Day
Related: Windows Zero-Day Attack Linked to North Korea’s Lazarus APT
Related: Justice Department Disrupts North Korean ‘Laptop Farm’ Operation
