UNC1069
Also known as MASAN, CryptoCore, MIDNIGHT NEPTUNE
CryptoCore is a North Korean APT known for targeting cryptocurrency exchanges and financial institutions, employing spear-phishing techniques that lead to LONEJOGGER malware infections. The group has leveraged social engineering tactics, including deepfake technology and hijacked YouTube accounts, to execute sophisticated giveaway scams that deceive victims into sending cryptocurrencies. Their operations have involved the misuse of platforms like Gemini for reconnaissance and the development of fraudulent content. Additionally, CryptoCore has been linked to a variety of campaigns, including Dangerous Password and SnatchCrypto, focusing on financial gain through cryptocurrency theft.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
- SEAL weekly stats: 28 Oct - 3 Nov 2026 published by SecurityAlliance. # UNC1069 , # ContagiousInterview https:// radar.securityalliance.org/sea l-weekly-stats-2mastodon · Nov 4, 2026
- SEAL weekly stats: 20-27 Oct, 2026 published by SecurityAlliance. # UNC1069 , # ContagiousInterview , # SINT69 https:// radar.securityalliance.org/sea l-weekly-mastodon · Oct 28, 2026
References
- https://www.mandiant.com/resources/blog/north-korea-cyber-structure-alignment-2023
- https://www.spixnet.com/cybersecurity-blog/2023/04/03/newly-exposed-apt43-hacking-group-targeting-us-orgs-since-2018/
- https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools/
- https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.