Threat actors connected to the North Korean government have been targeting security researchers in a hacking campaign that uses new techniques and malware in hopes of gaining a foothold inside the companies the targets work for, researchers said. Eventually, the threat actor tries to shift the conversations to WhatsApp and, from there, use either WhatsApp or email to deliver a backdoor Mandiant calls Plankwalk, or other malware families. ”The identified malware tools highlight continued malware development and deployment of new tools by UNC2970,” Mandiant researchers wrote