CryptoCore / UNC1069
North Korean financially motivated threat actors, AI-Enabled Social Engineering and the New Face of Crypto Intrusions.
The group widely tracked as CryptoCore, also referred to by Mandiant as UNC1069, has evolved from traditional spear-phishing campaigns into multi-stage intrusions powered by AI-generated deception, deepfake video, and tailored malware frameworks.
This is not opportunistic crime. It is structured, patient, and increasingly sophisticated.
A Familiar Actor with Evolving Tradecraft
CryptoCore has been active since at least 2018, primarily targeting:
