North Korea's UNC1069 Hammers Crypto Firms With AI

Back Darkreading

North Korea's UNC1069 Hammers Crypto Firms With AI

Darkreading •Alexander Culafi • February 11, 2026

Share: View original

In moving away from traditional banks to focus on Web3 companies, the threat actor is leveraging LLMs, deepfakes, legitimate platforms, and ClickFix.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

North Korean Hackers Use AI Deepfakes in Crypto Attacks Google's Mandiant security team reported that North Korean hackers, identified as UNC1069 or 'CryptoCore', are employing AI-generated deepfakes in fraudulent video meetings to target cryptocurrency companies. The investigation revealed a recent intrusion at a fintech firm linked to these sophisticated tactics, which included using a compromised Telegram account for the attack. 20 sources 30

Extracted Entities

APT Groups (1)

Countries (1)

Malware (1)