UNC2970__2023__Mandiant_LIGHTSHOW-1-North-Koreas-UNC2970_03-09-2023.pdf

This Mandiant report analyzes UNC2970, a suspected North Korean espionage group, detailing a sustained phishing-based intrusion campaign targeting U.S. and European media and technology organizations. It describes the use of LinkedIn fakery, WhatsApp-based payload delivery, and multiple malware families (including TOUCHMOVE, SIDESHOW, TOUCHSHIFT, PLANKWALK, LIDSHIFT, LIDSHOT, TOUCHSHOT, TOUCHKEY, HOOKSHOT, CLOUDBURST) with cloud-enabled and Intune-based deployment, highlighting the actor's evolution and potential links to TEMP.Hermit as part of a broader, high-sophistication operation.