North Korean UNC2970 Hackers Expands Operations with New Malware Families

Mar 10, 2023Ravie LakshmananCyber Attack / Malware

A North Korean espionage group tracked as
UNC2970 has been observed employing previously
undocumented malware families as part of a spear-phishing campaign
targeting U.S. and European media and technology organizations
since June 2022.

Google-owned Mandiant said the threat cluster shares “multiple
overlaps” with a long-running^[1]
operation^[2]
dubbed^[3]
“Dream Job^[4]” that employs job
recruitment lures in email messages to trigger the infection
sequence.

UNC2970 is the new moniker designated by the threat intelligence
firm to a set of North Korean cyber activity that maps to UNC577
(aka Temp.Hermit), and which also comprises another nascent
threat cluster tracked as UNC4034.

The UNC4034 activity, as documented^[5]
by Mandiant in September 2022, entailed the use of WhatsApp to
socially engineer targets into downloading a backdoor^[6]
called AIRDRY.V2 under the pretext of sharing a skills assessment
test.

“UNC2970 has a concerted effort towards obfuscation and employs
multiple methods to do this throughout the entire chain of delivery
and execution,” Mandiant researchers said in a detailed^[7]
two-part^[8]
analysis, adding the effort specifically targeted security
researchers.

Temp.Hermit is one of the primary hacking units associated with
North Korea’s Reconnaissance General Bureau (RGB) alongside
Andariel^[9]
and APT38^[10] (aka BlueNoroff). All
three actor sets are collectively^[11] referred to as the
Lazarus Group^[12] (aka Hidden Cobra or
Zinc).

“TEMP.Hermit is an actor that has been around since at least
2013,” Mandiant noted^[13] in a March 2022 report.
“Their operations since that time are representative of Pyongyang’s
efforts to collect strategic intelligence to benefit North Korean
interests.”

The latest set of UNC2970 attacks are characterized by initially
approaching users directly on LinkedIn using “well designed and
professionally curated” fake accounts posing as recruiters.

The conversation is subsequently shifted to WhatsApp, after
which a phishing payload is delivered to the target under the guise
of a job description.

In some instances, these attack chains have been observed to
deploy trojanized versions of TightVNC (named LIDSHIFT), which is
engineered to load a next-stage payload labeled as LIDSHOT that’s
capable of downloading and executing shellcode from a remote
server.

Establishing a foothold within compromised environments is
achieved by means of a C++-based backdoor known as PLANKWALK that
then paves the way for the distribution of additional tooling such
as –

• TOUCHSHIFT – A malware dropper that loads
  follow-on malware ranging from keyloggers and screenshot utilities
  to full-featured backdoors
• TOUCHSHOT – A software that’s configured to
  take a screenshot every three seconds
• TOUCHKEY – A keylogger that captures
  keystrokes and clipboard data
• HOOKSHOT – A tunneling tool that connects over
  TCP to communicate with the command-and-control (C2) server
• TOUCHMOVE – A loader that’s designed to
  decrypt and execute a payload on the machine
• SIDESHOW – A C/C++ backdoor that runs
  arbitrary commands and communicates via HTTP POST requests with its
  C2 server

UNC2970 is also said to have leveraged Microsoft Intune, an
endpoint management solution, to drop a bespoke PowerShell script
containing a Base64-encoded payload referred to as CLOUDBURST, a
C-based backdoor that communicates via HTTP.

In what’s a continuing use of the Bring Your Own Vulnerable
Driver (BYOVD^[15]) technique by North
Korea-aligned actors, the intrusions further employ an
in-memory-only dropper called LIGHTSHIFT that facilitates the
distribution of another piece of malware codenamed LIGHTSHOW.

The utility, besides taking steps to hinder dynamic and static
analysis, drops a legitimate version of a driver with known
vulnerabilities to perform read and write operations to kernel
memory and ultimately disarm security software installed on the
infected host.

“The identified malware tools highlight continued malware
development and deployment of new tools by UNC2970,” Mandiant said.
“Although the group has previously targeted defense, media, and
technology industries, the targeting of security researchers
suggests a shift in strategy or an expansion of its
operations.”