Mandiant tracks UNC2970 as a suspected North Korean espionage cluster targeting Western media and technology organizations, including security researchers, with job-recruitment themed spear phishing. The group used fake LinkedIn recruiter personas to move conversations to WhatsApp, then delivered malicious Word documents or ZIP/ISO payloads disguised as job descriptions or skills assessments. Observed tooling included PLANKWALK, LIDSHIFT, TOUCHMOVE, SIDESHOW, and TOUCHSHIFT, with remote-template injection and compromised WordPress sites used for C2 or payload staging. The activity overlaps UNC577/Temp.Hermit tradecraft and shows UNC2970 adapting social engineering, cloud-environment operations, and EDR-aware intrusion tactics.