North Korean threat actors operating on behalf of the UNC2970 threat group have been conducting malicious espionage activity against western media and technology corporations since June 2022. The group shows strong attribution back to the UNC577 threat group, which has conducted numerous malicious campaigns since their emergence in 2013. In this new campaign, UNC2970 actors utilize social platforms such as LinkedIn to pose as job recruiters and begin conversing with individuals, primarily security researchers. As the conversation persists, threat actors insist on shifting communications to WhatsApp where the malicious activities would begin. After some time, the threat actor will send the user a job description via a Microsoft Word document, which is laced with macro-malware and performs a remote-template injection. Once injected, the macro-code will begin downloading malicious payloads from actor-controlled command-and-control (C2) nodes, including the trojanized variant of TightVNC dubbed “LIDSHIFT”. This trojan will gather information from the user’s system, such as the device name, product name, IP address, current process list, and will relay that information back to threat actor C2 servers. In addition to LIDSHIFT, UNC2970 actors have also been known to deploy additional malware such as “PLANKWALK”, “LIDSHOT”, “CLOUDBURST”, “TOUCHSHIFT”, “SIDESHOW”, “TOUCHKEY”, “TOUCHSHOT”, and “HOOKSHOT”. Detailed indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs), and malicious code are available for review in the below linked report.