A new wave of cyber-espionage linked to North Korea is zeroing in on companies in the energy and aerospace industries, according to research from Mandiant. The campaign, attributed to a group known as UNC2970, is closely associated with the North Korean-backed threat actor TEMP.Hermit.
UNC2970’s recent activities, discovered in June 2024, highlight their sophisticated approach. Using email and WhatsApp, the hackers pose as recruiters from well-known companies, luring their targets by sharing job descriptions in a malicious archive. To open the provided “job description,” victims must use a trojanized version of the SumatraPDF document viewer, which, unbeknownst to them, installs a backdoor called Mistpen, delivered through the Burnbook launcher.
Although the legitimate SumatraPDF service itself was not compromised, the hackers utilized an older version of its open-source code for this campaign. Their tactics are highly targeted, focusing on U.S. critical infrastructure, which includes energy and aerospace sectors. In addition to this, the malware Mistpen is a modified version of a legitimate plugin for Notepad++, a widely-used text editor. Over time, the hackers have improved Mistpen by adding new features, including a network connectivity check that complicates analysis.
Mandiant’s findings suggest that the hackers are particularly interested in accessing confidential and sensitive information held by senior-level employees. These personalized recruitment messages are designed to align with the profiles of the victims, increasing the chances of success.
This campaign, which has impacted countries including the U.S., U.K., Germany, Singapore, and Hong Kong, underscores the ongoing global threat posed by North Korean-linked cyber actors, especially within industries of strategic importance like energy and aerospace. As these malicious efforts continue to evolve, companies must remain vigilant to protect their critical information from falling into the wrong hands.
Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com
