Loading story…
Google-owned Mandiant reported that threat actor UNC1069 targeted organizations in the cryptocurrency sector using newly observed tooling alongside AI-enabled social engineering. The campaign relied on deceptive outreach and impersonation tactics designed to build trust with victims, reflecting a broader shift toward using generative AI to improve the scale and plausibility of intrusion attempts against high-value financial targets.
Mandiant said the activity combined social engineering with custom or newly tracked attacker tooling to support compromise efforts against crypto-related entities. The report highlights the cryptocurrency industry as a continued focus for financially motivated threat activity, with attackers blending traditional intrusion tradecraft and AI-assisted lures to increase the likelihood of successful access and follow-on theft.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Google Cloud's Mandiant Threat Intelligence team published a report describing UNC1069 targeting the cryptocurrency sector using new tooling and AI-enabled social engineering. The reference does not provide earlier dated incident details, so the publication itself is the only extractable event.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**North Korean threat actor UNC1069** has escalated targeted intrusions against the **cryptocurrency and broader finance sector** by combining highly tailored social engineering with new malware tooling. Victims are approached via professional messaging platforms (notably **Telegram**) using recruiter/executive pretexts and, in at least one case, a **compromised account of another crypto executive** to increase credibility. Lures include scheduling links (e.g., Calendly) that lead to **spoofed video meetings**; incident reporting described a call where the victim was shown what appeared to be a **deepfake video of a crypto CEO**, though responders noted they could not independently verify AI model use in that specific instance. During the meeting, operators feign technical issues and direct the target to “fix” audio/video problems—an example of the **ClickFix** technique—by running provided troubleshooting steps. The embedded command sequence contains a malicious line that initiates infection; in the documented case, this resulted in **macOS compromise** and deployment of backdoors identified as **WAVESHAPER** and **HYPERCALL**, enabling follow-on tool delivery and persistence. Reporting attributes the campaign’s objective to **credential/session token and browser data theft** to facilitate **financial theft (e.g., draining crypto wallets)**, and notes an expanded toolkit observed on victim hosts, including multiple distinct malware families (custom backdoors and browser extensions) intended to bypass defenses and maximize data extraction before detection.
Jun 29, 2026
Microsoft-linked reporting says **North Korean threat actors** are using **AI** to scale and refine long-running “fake IT worker” schemes, where operatives pose as legitimate remote hires to obtain *authorized* access inside victim organizations. The activity is attributed to DPRK-linked clusters **Jasper Sleet** and **Coral Sleet**, with AI used to improve identity fabrication and maintenance (including face/voice manipulation) and to sustain day-to-day communications that help keep fraudulent personas credible, enabling “sustained, large-scale misuse of legitimate access.” Separately, reporting on suspected DPRK-linked intrusions describes a coordinated campaign against **cryptocurrency organizations** spanning staking platforms, exchange software providers, and exchanges, with theft of **source code, private keys, and cloud secrets**. Investigators described two primary access paths: exploitation of `CVE-2025-55182` in the *React2Shell* framework (including mass scanning and WAF-bypass techniques) and the use of **pre-obtained valid AWS access tokens** to move directly into cloud enumeration; researchers also recovered artifacts from attacker infrastructure (e.g., shell history, archived code, and tool configurations) that provided visibility into post-compromise activity and C2 setup.
Jun 29, 2026
Major Wall Street firms, hedge funds, and private-equity organizations were targeted in a recent wave of attempted cyberattacks that used phone-based social engineering to gain access to corporate systems. Reported targets included **Point72 Asset Management, Millennium Management, Two Sigma Investments, and Citadel**; Point72 said it found no evidence that client data was stolen, while Two Sigma said it blocked an attempted intrusion with no sign of impact. Reuters and Bloomberg also reported that several private-equity firms were targeted in the same campaign. Researchers attributed the activity to **UNC6671**, an extortion group previously associated with the public brand **BlackFile** and now linked to brands including **Redact, Pink, Helix, and Falcon**. According to Google Threat Intelligence Group and Mandiant, the attackers used help-desk voice phishing to persuade employees to change passkeys or MFA settings, then redirected victims to adversary-in-the-middle phishing pages that captured **Microsoft 365** or **Okta** credentials and session cookies. Investigators said the group shifted in July toward hedge funds, private-equity firms, major law firms, and financial-rating agencies, and tracked more than **$10.6 million** in Bitcoin payments to wallets tied to the operation between January and May 2026.
Aug 8, 2026