North Korea's UNC1069 Targets Cryptocurrency Professionals with Fake Meetings

• •UNC1069 is targeting cryptocurrency and Web3 professionals through fake online meetings.
• •The attack employs social engineering to build trust before deploying malware.
• •Victims are affected across Windows, macOS, and Linux systems.

A North Korea-linked threat actor, UNC1069, is executing a targeted campaign aimed at cryptocurrency and Web3 professionals. The attackers lure victims into fake Zoom, Google Meet, and Microsoft Teams meetings, where they deploy multi-stage malware to steal digital assets. This operation is characterized by social engineering tactics that build trust with the targets, often posing as venture capital firms seeking investment partnerships. The campaign affects users across multiple operating systems, including Windows, macOS, and Linux. The attackers aim for long-term access to victims' systems, leading to large-scale theft of digital assets. The current status indicates ongoing activity with no reported takedowns or mitigations. Specific numbers and tools used in the attacks have not been disclosed. The sophistication of the campaign suggests a well-resourced threat actor with state sponsorship.