North Korea-Linked UNC1069 Uses AI Lures to Attack Cryptocurrency Organizations

The North Korea-linked threat actor UNC1069 has been observed targeting the cryptocurrency sector to steal sensitive data from Windows and macOS systems, with the ultimate goal of facilitating financial theft, using a complex social engineering scheme involving AI-generated videos and fake Zoom meetings. According to Google Mandiant researchers, the intrusion relied on a compromised Telegram account, a fake Zoom meeting, and a ClickFix infection vector.

Why This Matters

The use of AI-generated videos and deepfakes by UNC1069 highlights the increasing sophistication of social engineering campaigns, which can have significant financial consequences for targeted organizations, with potential losses in the millions of dollars. The fact that UNC1069 has been able to evade detection for several years and has expanded its capabilities to include multiple new malware families underscores the need for organizations to stay vigilant and adapt their security measures to counter these evolving threats.

Key Insights

UNC1069 has been active since at least April 2018, with a history of conducting social engineering campaigns for financial gain: Google Mandiant, 2026
The threat actor has used generative artificial intelligence (AI) tools like Gemini to produce lure material and other messaging related to cryptocurrency: Google Threat Intelligence Group, 2025
UNC1069 has deployed as many as seven unique malware families, including SILENCELIFT, DEEPBREATH, and CHROMEPUSH, to steal credentials, browser data, and funds: Google Mandiant, 2026

Working Example

// Example of a C++ malware component (e.g., WAVESHAPER) used by UNC1069
#include <iostream>
#include <fstream>
#include <string>

int main() {
    // Gather system information
    std::string systemInfo = "System Information: ";
    // ...
    // Distribute a Go-based downloader (e.g., HYPERCALL)
    std::string downloaderUrl = "https://example.com/hypercall";
    // ...
    return 0;
}

Practical Applications

Use Case: Cryptocurrency startups and venture capital firms can use this information to inform their security measures and protect against UNC1069’s social engineering campaigns.
Pitfall: Organizations that fail to adapt their security measures to counter evolving threats like UNC1069 may be vulnerable to significant financial losses.

References:

On This Page

North Korea-Linked UNC1069 Uses AI Lures to Attack Cryptocurrency Organizations