UNC2970

Overview 13 indicators

No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.

Principal sources 2 reports

Ranked by how many of this actor's indicators each report brought in.

• 13mandiant.com/resources/blog/lightshift-and-lightshow
• 13otx.alienvault.com/pulse/640feb918ed0617c50fe21a3

Related groups 1

What the sources have in common — not a claim that these are the same actor. See the whole graph.

• Lazarus Group G0032
  2 shared indicators

Timeline 13 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2023-03-14 11 url3 yrs ago

   mandiant.com/resources/blog/lightshift-and-lightshow · otx.alienvault.com/pulse/640feb918ed0617c50fe21a3

   abba-servicios.mx/wordpress/wp-content/themes/config.php

   ajayjangid.in/js/jquery/jquery.php

   crickethighlights.today/wp-content/plugins/contact.php

   doug.org/wp-includes/admin.php

   fainstec.com/assets/js/jquery/jquery.php

   keewoom.co.kr/prod_img/201409/prod.php

   mantis.quick.net.pl/library/securimage/index.php

   ruscheltelefonia.com.br/public/php/index.php

   sede.lamarinadevalencia.com/tablonEdictal/layout/contentLayout.jsp

   toptradenews.com/wp-content/themes/themes.php

   webinternal.anyplex.com/images/query_image.jsp

   copy batch

2. 2022-11-25 1 url4 yrs ago

   mandiant.com/resources/blog/lightshift-and-lightshow · otx.alienvault.com/pulse/640feb918ed0617c50fe21a3

   olidhealth.com/wp-includes/php-compat/compat.php

   copy batch

3. 2022-11-06 1 url4 yrs ago

   mandiant.com/resources/blog/lightshift-and-lightshow · otx.alienvault.com/pulse/640feb918ed0617c50fe21a3

   leadsblue.com/wp-content/wp-utility/index.php

   copy batch

Further reading 2

• mandiant.com/resources/blog/lightshift-and-lightshow
• otx.alienvault.com/pulse/640feb918ed0617c50fe21a3