Quick Summary
The North Korea-linked threat actor UNC1069 has been targeting cryptocurrency organizations to steal sensitive data from Windows and macOS systems. This attack employs social engineering tactics, including a compromised Telegram account and fake Zoom meetings, to facilitate financial theft. The group has utilized AI-generated video content and multiple malware families, including SILENCELIFT and DEEPBREATH, to enhance their operations since at least April 2018.
The Securityish Brief
UNC1069, a North Korea-linked threat actor, has been actively targeting the cryptocurrency sector, aiming to steal sensitive data from both Windows and macOS systems. This group has been operational since at least April 2018 and is known for its social engineering campaigns that often involve impersonating investors on platforms like Telegram. Their recent tactics include using compromised accounts to schedule fake meetings through Calendly, leading victims to a fraudulent Zoom interface.
During these fake meetings, victims are tricked into enabling their cameras and entering personal information. The attack is further complicated by the use of deepfake technology, where videos of previous victims are replayed to create the illusion of a live call. This sophisticated approach has allowed UNC1069 to deploy multiple malware families, including SILENCELIFT, DEEPBREATH, and CHROMEPUSH, to facilitate their financial theft.
In the latest documented intrusion, UNC1069 has reportedly used as many as seven unique malware families, showcasing an expansion in their capabilities. The malware is designed to gather system information and steal sensitive data, including iCloud Keychain credentials and browser data from platforms like Google Chrome and Microsoft Edge.
Why This Matters for Your Security
The tactics employed by UNC1069 highlight the increasing sophistication of cyber threats targeting the cryptocurrency industry. Users and organizations should be aware of the potential for deepfake technology to be used in social engineering attacks. The impersonation of trusted individuals or entities can lead to significant financial loss and data breaches.
As UNC1069 shifts its focus towards the Web3 industry, including centralized exchanges and venture capital firms, it is crucial for these organizations to enhance their security measures. Regular monitoring of communication channels and verification of meeting requests can help mitigate the risks associated with such attacks.
Organizations should also consider implementing robust security protocols, including multi-factor authentication and regular software updates, to protect against the deployment of malware like HYPERCALL and DEEPBREATH. Awareness training for employees on recognizing phishing attempts and suspicious communications is essential in maintaining a strong security posture.
- SILENCELIFT: A minimalist C/C++ backdoor that sends system information to a command-and-control server.
- DEEPBREATH: A data stealer that manipulates macOS’s TCC database to access sensitive information.
- CHROMEPUSH: A browser extension masquerading as a Google Docs tool, capable of recording keystrokes and stealing cookies.
- HYPERCALL: A Go-based downloader used to serve additional malicious payloads.
- SUGARLOADER: A C++ downloader that deploys other malware components.
Key Takeaways
- Verify the authenticity of meeting requests, especially those from unknown contacts on platforms like Telegram.
- Enable multi-factor authentication on all accounts to add an extra layer of security against unauthorized access.
- Regularly update software and security protocols to protect against known vulnerabilities and malware.
- Educate employees about the risks of deepfake technology and social engineering tactics used in phishing attacks.
- Monitor accounts for unusual activity and promptly report any suspicious communications.
Key Terms & Concepts
- UNC1069: In this article, UNC1069 refers to a North Korea-linked threat actor targeting cryptocurrency organizations.
- Deepfake: Deepfake technology involves using artificial intelligence to create realistic-looking fake videos or audio recordings.
- SILENCELIFT: SILENCELIFT is a minimalist backdoor malware that collects system information and communicates with a command-and-control server.
- DEEPBREATH: DEEPBREATH is a malware designed to manipulate macOS’s TCC database to steal sensitive user data.
- CHROMEPUSH: CHROMEPUSH is a browser extension malware that masquerades as a legitimate tool while stealing user credentials and data.
Read the original article here: https://thehackernews.com/2026/02/north-korea-linked-unc1069-uses-ai.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
