UNC1069 Targets Crypto with AI-Driven Social Engineering Tactics

What Happened

In a shocking development, North Korean threat actor UNC1069 has ramped up its efforts in the cryptocurrency sector. Recently, Mandiant investigated an intrusion involving a FinTech company that revealed the deployment of seven unique malware families. Among these are new tools like SILENCELIFT, DEEPBREATH, and CHROMEPUSH, specifically designed to capture sensitive data from victims.

The attack began with a compromised Telegram account belonging to a cryptocurrency executive. UNC1069 used this account to build trust with the victim, eventually leading them to a fake Zoom meeting. During this meeting, a deepfake video was presented, making the scam seem even more convincing. This tactic is part of a broader trend where threat actors are increasingly using AI to enhance their social engineering schemes.

In addition to the initial findings, recent investigations have uncovered that UNC1069 has been using fake online meetings not only on Zoom but also on platforms like Microsoft Teams and Google Meet. They often pose as venture capital firms seeking investment partnerships, gradually building trust with their targets before delivering malicious payloads through counterfeit video conferencing platforms. The attackers make first contact through LinkedIn and Telegram, sometimes leveraging previously compromised accounts to appear more legitimate.

Once victims join these fake meetings, they are often met with prompts that create a sense of urgency, pressuring them to resolve supposed technical issues with their audio or video. This leads to the execution of malicious code that installs malware on their systems, specifically targeting the operating system in use, whether Windows, macOS, or Linux. The malware is believed to be updated variants of Cabbage RAT, also known as CageyChameleon.

Expanded Tactics

Recent intelligence indicates that UNC1069's tactics are evolving. They are now employing more sophisticated social engineering strategies, similar to those observed in other threat groups like UNC6692. This includes impersonating IT helpdesk personnel and using platforms such as Microsoft Teams to initiate contact. By creating a sense of urgency through overwhelming email campaigns, they distract victims while executing their malicious plans.

In late December 2025, UNC6692 conducted a large email campaign designed to overwhelm targets with messages, creating a sense of urgency and distraction. Following this, attackers sent phishing messages via Microsoft Teams, posing as helpdesk personnel offering assistance. This multi-stage approach highlights how UNC1069 may also be leveraging similar strategies to enhance their effectiveness.

Why Should You Care

If you’re involved in the cryptocurrency world, this is a wake-up call. Your sensitive data and funds are at risk. The techniques employed by UNC1069 show how sophisticated cybercriminals have become. Imagine someone using a fake video of a trusted CEO to manipulate you into revealing your passwords or installing malware. It’s like a con artist impersonating a friend to gain access to your bank account.

This incident highlights the importance of vigilance. Cybersecurity is not just a concern for big companies; it affects everyone. Whether you’re a developer, an investor, or just someone using crypto, you need to be aware of these tactics. Protecting your assets is crucial. The campaign's financial motivation is believed to directly support North Korea’s missile, nuclear, and espionage programs, making it even more critical to stay informed.

What's Being Done

Mandiant and other cybersecurity experts are on high alert. They are analyzing the techniques used by UNC1069 to develop countermeasures. Here are some immediate actions you should consider:

• Verify communications: Always double-check the identity of anyone reaching out to you, especially on platforms like Telegram.
• Use secure meeting links: Be cautious about links sent via messaging apps; ensure they direct to legitimate platforms.
• Educate yourself: Stay informed about the latest scams and tactics used by threat actors.
• Monitor for unusual activity: Be alert for unexpected requests to run terminal commands during video calls, as these can indicate a potential attack.

Experts are closely monitoring UNC1069’s activities and the evolving use of AI in cybercrime. The landscape is changing, and staying ahead of these threats is essential for your safety.