UNC1069Threat actor
- CryptoCore
- masan
- MIDNIGHT NEPTUNE
CryptoCore is a North Korean APT known for targeting cryptocurrency exchanges and financial institutions, employing spear-phishing techniques that lead to LONEJOGGER malware infections. The group has leveraged social engineering tactics, including deepfake technology and hijacked YouTube accounts, to execute sophisticated giveaway scams that deceive victims into sending cryptocurrencies.From MISP Galaxy
Last reported 1 month ago, by Google Threat Intelligence8 reports
ATT&CK techniques
6 of 19 · each with the sentence it comes from- T1195Supply Chain Compromise
“Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise”
- T1684Social Engineering
“GTIG analysis and the maintainer's post mortem indicate that the maintainer account was compromised via social engineering and used to publish the updated versions.”
- T1036Masquerading
“Masquerading CI/CD Pipeline Tasks as Legitimate AI Utilities”
- T1055Process Injection
“…g assistants such as DeepSeek-Coder to develop Python-based Remote Access Trojans (RATs) incorporating cross-platform persistence, process injection, fileless execution, defense evasion, and C2 notifications.”
- T1564.003Hidden Window
“| Anti-forensics | Hidden windows, temp file cleanup | Hidden temp .scpt | Hidden /tmp/.XXXXXX files |”
- T1657Financial Theft
“Salaries were remitted to North Korea to help circumvent sanctions, while access obtained through employment could also support financial theft or espionage.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
8 reports, newest first · the exact sentence from each-
GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI“MIDNIGHT NEPTUNE, financially motivated North Korea-nexus threat clusters formerly tracked as UNC1069, have increasingly integrated AI across their operational lifecycles to support cryptocurrency theft.”
-
North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters“The research, published on September 7, categorized the former Lazarus umbrella into TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet and Famous Chollima.”
-
Beyond Lazarus: How North Korea Organizes Its Cyber Operations“We notably made our clustering evolved by splitting the Lazarus umbrella into six distinct sub-clusters: TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet, and Famous Chollima.”
-
Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise“…ed the malicious dependency as a dropper that deploys the WAVESHAPER.V2 backdoor, and attributes the activity to North Korean actor MIDNIGHT NEPTUNE (formerly known as UNC1069).”
-
Cuando el software confiable falla: ataques a la cadena de suministro open source en 2026“El caso de Axios fue atribuido a UNC1069, también conocido como Sapphire Sleet, un grupo APT vinculado a los intereses de Corea del Norte, y cuya principal motivación es la ganancia financiera.”
-
Tradecraft Tuesday Recap: axios npm Supply Chain Compromise“Various researchers have pointed to links in the attack to DPRK infrastructure, with Google attributing the incident specifically to UNC1069, a financially motivated North Korean threat actor active since at least 2018.”
-
Inside the Axios supply chain compromise - one RAT to rule them all“…the plain-crypto-js postinstall hook exhibits significant overlap with WAVESHAPER, a C++ backdoor tracked by Mandiant and attributed to UNC1069, a DPRK-linked threat cluster.”
-
Supply Chain Compromise of axios npm Package“Google Threat Intelligence Group has also attributed the attack to UNC1069, a suspected North Korean threat actor.”
Indicators in its reports
named in the reports above- sfrclak[.]comin 2 reports
- packages.npm[.]orgin 2 reports
- 142.11.206[.]73in 2 reports
- 617b67a8e1210e4f…f583c900d101in 2 reports
- 92ff08773995ebc8…071230c9645ain 2 reports
- fcb81618bb15edfd…02bf980375cfin 2 reports
- hxxp://sfrclak[.]com:8000/6202033in 2 reports
- 23.237.102[.]130in 1 report
- 37.120.154[.]98in 1 report
- 38.75.137[.]97in 1 report
- 45.86.208[.]162in 1 report
- 50.7.159[.]34in 1 report
- 91.239.130[.]102in 1 report
- 103.214.44[.]138in 1 report
- 167.88.61[.]117in 1 report
- 185.135.76[.]89in 1 report
- 188.43.33[.]252in 1 report
- 211.21.6[.]181in 1 report
- 70.32.3[.]15in 1 report
- 66.118.255[.]35in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.