UNC1069, a North Korean threat group, has been exploiting social engineering tactics and AI tools to infiltrate cryptocurrency companies. Their recent attack involved a compromised Telegram account, a fake Zoom meeting with a deepfake video, and multiple malware families to harvest sensitive data. The operation highlights a significant evolution in their methods since 2018.

This article details an organized cybercriminal operation that primarily targets cryptocurrency users and Web3 employees through sophisticated malware and social engineering tactics. The gang, linked to multiple traffer groups, has generated at least $2.4 million in theft, using fake applications and extensive infrastructure to deliver their attacks.