UNC6229

UNC6229 targets job seekers to steal advertising platform credentials. It is a distinct cluster from Lazarus Group (also tracked as Diamond Sleet, Hidden Cobra, and UNC2970), despite appearing in the same campaign reporting.