UNC1069
UNC1069 is classified as cybercrime.
- Malware families
- 2
- Origin
- North Korea
- Also known as
- 3
CryptoCore is a North Korean APT known for targeting cryptocurrency exchanges and financial institutions, employing spear-phishing techniques that lead to LONEJOGGER malware infections. The group has leveraged social engineering tactics, including deepfake technology and hijacked YouTube accounts, to execute sophisticated giveaway scams that deceive victims into sending cryptocurrencies. Their operations have involved the misuse of platforms like Gemini for reconnaissance and the development of fraudulent content. Additionally, CryptoCore has been linked to a variety of campaigns, including Dangerous Password and SnatchCrypto, focusing on financial gain through cryptocurrency theft.
The group's reported origin is North Korea.
The group is associated with 2 malware families.
Also known as: MASAN, CryptoCore, MIDNIGHT NEPTUNE
The group is associated with 2 malware families.
Malware families
- AmodalTea
- WAVESHAPER
Published reports on this actor:
- https://www.mandiant.com/resources/blog/north-korea-cyber-structure-alignment-2023
- https://www.spixnet.com/cybersecurity-blog/2023/04/03/newly-exposed-apt43-hacking-group-targeting-us-orgs-since-2018/
- https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools/
Source: MISP Galaxy, Malpedia.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.