North Korea-Linked UNC1069 Uses AI Lures to Attack Cryptocurrency Organizations

Google Mandiant and related reporting detail UNC1069 (aka CryptoCore/MASAN), a DPRK-linked actor targeting cryptocurrency industry victims via Telegram-based social engineering and fake Zoom meetings using AI/deepfake lures; the intrusion chain delivers a suite of new and known malware (WAVESHAPER, HYPERCALL, HIDDENCALL, DEEPBREATH, CHROMEPUSH, SILENCELIFT, SUGARLOADER) to harvest credentials, browser data, and session tokens to enable financial theft.