North Korea

Gbhackers •Mayura Kathir • April 20, 2026

North Korea-linked threat actor UNC1069 is running a highly targeted campaign that abuses fake Zoom, Google Meet, and Microsoft Teams meetings to compromise cryptocurrency and Web3 professionals across Windows, macOS, and Linux systems. The goal is long-term access and large-scale theft of digital assets through stealthy social engineering and multi-stage malware deployment. Attackers often hijack […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korea's UNC1069 Targets Cryptocurrency Professionals with Fake Meetings A North Korea-linked threat actor, UNC1069, is executing a targeted campaign aimed at cryptocurrency and Web3 professionals. The attackers lure victims into fake Zoom, Google Meet, and Microsoft Teams meetings, where they deploy multi-stage malware to steal digital assets. This operation is characterized by social engineering tactics that build trust with the targets, often posing as venture capital firms seeking investment partnerships. The campaign affects users across multiple operating systems, including Windows, macOS, and Linux. The attackers aim for long-term access to victims' systems, leading to large-scale theft of digital assets. The current status indicates ongoing activity with no reported takedowns or mitigations. Specific numbers and tools used in the attacks have not been disclosed. The sophistication of the campaign suggests a well-resourced threat actor with state sponsorship. 2 sources 73

Extracted Entities

North Korea

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

MITRE ATT&CK (1)

Platforms (5)

Tools (1)