Skip to content
brandefense.io
Request A Demo
UnclassifiedIdeologyAdvanced sophistication

UNC2970

UNC2970 is a threat actor group with an ideological motive, tracked by Brandefense. It uses 9 MITRE ATT&CK techniques.

Request IOC feedRequest ATT&CK export
Techniques
9
Exploited CVEs
No CVE data
Record updated

About UNC2970.

UNC2970 is a North Korean threat actor that primarily targets organizations through spear-phishing emails with job recruitment themes, often utilizing fake LinkedIn accounts to engage victims. The group employs the PLANKWALK backdoor and other malware families, leveraging compromised WordPress sites for command and control. They have been observed using BYOVD techniques to exploit vulnerable drivers for evading detection.

Last updated Sep 12, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.