CampaignPublished 9 Feb 2026Updated 12 Feb 2026

UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering

Source AlienVault OTX General

Description

North Korean threat actor UNC1069 has evolved its tactics to target the cryptocurrency and decentralized finance sectors. In a recent intrusion, they deployed seven unique malware families, including new tools SILENCELIFT, DEEPBREATH, and CHROMEPUSH, designed to capture host and victim data. The attack utilized social engineering involving a compromised Telegram account, fake Zoom meeting, and reported AI-generated video. UNC1069 has shifted from spear-phishing to targeting Web3 industry entities like centralized exchanges, software developers, and venture capital firms. The intrusion demonstrated sophisticated techniques to bypass macOS security features and harvest credentials, browser data, and cryptocurrency information. This marks a significant expansion in UNC1069's capabilities and highlights their focus on financial theft and fueling future social engineering campaigns.

Impact

For European organizations, particularly those involved in cryptocurrency trading, blockchain development, and venture capital investments in Web3 technologies, this threat poses substantial risks. Successful intrusions can lead to the theft of sensitive credentials, browser data, and cryptocurrency assets, resulting in direct financial losses and reputational damage. The use of AI-enabled social engineering increases the likelihood of successful victim compromise, potentially leading to broader network infiltration and data breaches. The targeting of macOS systems, which are prevalent in many European tech firms, expands the attack surface beyond traditional Windows environments. Additionally, compromised credentials and stolen data can facilitate subsequent attacks, including fraudulent transactions, unauthorized access to critical infrastructure, and disruption of financial services. The campaign may also undermine trust in cryptocurrency platforms and delay adoption of decentralized finance solutions in Europe. Regulatory and compliance repercussions could arise if personal or financial data is exposed, impacting GDPR obligations.

Defensive guidance

European organizations should implement multi-layered defenses tailored to the unique tactics of UNC1069. Specific measures include: 1) Enhancing endpoint detection and response (EDR) capabilities on macOS systems to identify and block the novel malware families SILENCELIFT, DEEPBREATH, and CHROMEPUSH; 2) Deploying advanced email and messaging security solutions that incorporate AI-based anomaly detection to identify and quarantine AI-generated social engineering content; 3) Conducting targeted user awareness training focused on recognizing AI-driven social engineering tactics, including fake video calls and compromised messaging accounts; 4) Enforcing strict multi-factor authentication (MFA) across all cryptocurrency platforms, developer tools, and communication channels to limit credential misuse; 5) Monitoring network traffic for indicators of compromise related to the malware families and suspicious command-and-control communications; 6) Implementing robust credential hygiene practices, including regular password changes and use of hardware security keys; 7) Collaborating with threat intelligence sharing groups to stay updated on emerging UNC1069 tactics and indicators; 8) Applying least privilege principles to limit lateral movement and data access within networks; 9) Validating the integrity of software development environments and supply chains to prevent compromise; 10) Preparing incident response plans specifically addressing AI-enhanced social engineering and cryptocurrency theft scenarios.

Indicators of compromise

Domains 8

breakdream.com
cmailer.pro
dreamdie.com
mylingocoin.com
support-zoom.us
supportzm.com
zmsupport.com
zoom.uswe05.us

Hashes 23

3712793d3847dd0962361aa528fa124c
4e4f2dfe143ba261fd8a18d1c4b58f2e
c91725905b273e81e9cc6983a11c8d60
eb7635f4836c9e0aa4c315b18b051cb5
03f00a143b8929585c122d490b6a3895d639c17d92c2223917e3a9ca1b8d30f9
1a30d6cdb0b98feed62563be8050db55ae0156ed437701d36a7b46aabf086ede
603848f37ab932dccef98ee27e3c5af9221d3b6ccfe457ccf93cb572495ac325
b452c2da7c012eda25a1403b3313444b5eb7c2c3e25eee489f1bd256f8434735
b525837273dde06b86b5f93f9aec2c29665324105b0b66f6df81884754f8080d
c3e5d878a30a6c46e22d1dd2089b32086c91f13f8b9c413aa84e1dbaa03b9375

Yara 8

0cb0c982cbd55207c4f4d95c193c382502f98bed
4ab192b8b8298bbc157fa7d20e922bf00db7df58
6b372fe49880513178857a66da43b6b760b2eac5
710bfacd6d55a8794ce11b5143a85f9ca1854433
75e0ecb0228e9d4575614c97710f9f42f48f3736
8846fe4767326d60fe5d6f215bb5c7d308b0995c
ad20ee8be71f187596a450a4d9ab03dfca15567f
cd9cf6ec80415dca7ad4c6c976cf8f9df64f4428

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 9 Feb 2026, 20:46 UTC

MITRE ATT&CK techniques12 from threat tags

Technical details

Indicators of compromise

Domains 8

Hashes 23

Yara 8

Community reviews

Related threats