UNC1069 Targets Financial Firms With New Tools and AI-Driven Social Engineering Attacks

UNC1069, a North Korean financially motivated threat actor active since 2018, executed a sophisticated campaign against a FinTech/cryptocurrency organization using AI-enabled social engineering (a spoofed Calendly/Zoom meeting and a reported deepfake) and deploying seven malware families—including new tools SILENCELIFT, DEEPBREATH, and CHROMEPUSH—to harvest credentials, browser data, and session tokens; the report outlines ClickFix tactics, detailed TTPs, and multiple IOCs (malicious domains and C2 servers).