Mandiant observed UNC2970 targeting victims under the guise of job openings, masquerading as a recruiter for prominent companies. To target victims employed in U.S. critical infrastructure verticals, UNC2970 relies on legitimate job openings. The job description is delivered to the victim in a password-protected ZIP archive containing an encrypted PDF file and a modified version of an open-source PDF viewer application. The threat actor modified the open source code of an older SumatraPDF version (3.3.3) as part of this campaign, so this is not a vulnerability in SumatraPDF itself. Targeted users were instructed to open the PDF file with the enclosed trojanized PDF viewer program. The playbook is not new: Microsoft described in 2022 how the North Korean actor it tracks as ZINC approached targets as fake recruiters on LinkedIn and delivered trojanized PuTTY, KiTTY, TightVNC and Sumatra PDF builds over WhatsApp.
