North Korea

Cybersecuritynews •Tushar Subhra Dutta • April 20, 2026

A North Korean threat group known as UNC1069 has been running a sophisticated campaign that tricks cryptocurrency and Web3 professionals into joining fake online meetings, only to infect their computers with malware designed to steal digital assets. The group pretends to be venture capital firms looking for investment partnerships, building trust with targets over time […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korea's UNC1069 Targets Cryptocurrency Professionals with Fake Meetings A North Korea-linked threat actor, UNC1069, is executing a targeted campaign aimed at cryptocurrency and Web3 professionals. The attackers lure victims into fake Zoom, Google Meet, and Microsoft Teams meetings, where they deploy multi-stage malware to steal digital assets. This operation is characterized by social engineering tactics that build trust with the targets, often posing as venture capital firms seeking investment partnerships. The campaign affects users across multiple operating systems, including Windows, macOS, and Linux. The attackers aim for long-term access to victims' systems, leading to large-scale theft of digital assets. The current status indicates ongoing activity with no reported takedowns or mitigations. Specific numbers and tools used in the attacks have not been disclosed. The sophistication of the campaign suggests a well-resourced threat actor with state sponsorship. 2 sources 73

Extracted Entities

North Korea

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

MITRE ATT&CK (1)