Featured image courtesy of GovTech. 
Source: Artificial Intelligence Making Cyber Crime Harder to Fight 

Introduction 

Artificial intelligence is reshaping the cyber threat landscape, and few groups demonstrate this shift more clearly than UNC1069—a North Korean–linked actor now leveraging AI‑driven social engineering, deepfake‑based impersonation, and multi‑stage malware to infiltrate financial and cryptocurrency organizations. By combining compromised executive accounts with convincing AI‑generated video personas, UNC1069 creates high‑trust scenarios that lead victims into executing malicious “troubleshooting” commands, enabling credential theft, persistent access, and large‑scale financial exploitation. This blog explores UNC1069’s tactics and outlines how organizations can strengthen their defenses against these evolving threats. 

UNC1069: An Evolving Cyber Threat Actor 

UNC1069, a threat group associated with North Korea, continues to increase its operational sophistication across financial and cryptocurrency sectors. Recent intelligence reveals that the group integrates AI‑driven social engineering, deepfake media, and multiple coordinated malware families within individual intrusions. These advancements reflect a strategic and well‑organized effort to expand access, persistence, and targeted data theft within highly valuable financial environments. 

Characteristics of UNC1069’s Current Activity 

• The group uses multi‑stage, AI‑supported attack workflows as its primary method of operation. 

• UNC1069 deploys seven malware families during a single intrusion to establish layered access. 

• Collection efforts focus on credentials, browser data, and session tokens used for financial exploitation. 

AI‑Enabled Social Engineering and Deepfake Usage 

AI plays a central role in UNC1069’s impersonation strategy. Attacks often begin with compromised Telegram accounts belonging to real executives in the financial industry. These accounts are used to lure victims into spoofed video meetings where deepfake avatars impersonate trusted individuals. This combination of social familiarity, AI‑generated likenesses, and real‑time engagement increases the likelihood of victims complying with technical requests. 

Techniques Used in AI‑Based Impersonation 

• Attackers contact targets through compromised Telegram executive accounts to establish credibility. 

• Deepfake videos represent familiar executives to enhance trust during meetings. 

• Prolonged communication helps create conditions for subsequent technical manipulation. 

ClickFix: Social Engineering Through Simulated Technical Issues 

One of UNC1069’s most effective strategies is the ClickFix technique. During fake video calls, attackers simulate fabricated technical issues—often audio failures—to manipulate the victim into running “diagnostic commands.” These commands are actually malware installers disguised as troubleshooting steps. 

Elements of the ClickFix Approach 

• Simulated errors prompt victims to run command‑line instructions believed to be diagnostic. 

• The entered commands result in malware installation and remote access setup. 

• User‑initiated execution may circumvent baseline protective measures. 

Malware Families Utilized in UNC1069 Operations 

UNC1069 maintains a diverse malware ecosystem tailored for credential theft, data harvesting, communications interference, and persistent access. Newly observed tools such as DEEPBREATH, CHROMEPUSH, and SILENCELIFT expand the group’s capabilities across macOS, browsers, and messaging platforms. 

Functions of Key Malware Components 

• DEEPBREATH extracts macOS Keychain credentials, browser data, and information from Telegram and Apple Notes. 

• CHROMEPUSH acts as a disguised browser extension capturing keystrokes, login inputs, and authentication cookies. 

• SILENCELIFT gathers system information and can interfere with Telegram communications. 

Together, these malware families support credential theft, session hijacking, and long‑term presence across compromised systems. 

Expansion Into Broader Financial Sectors 

UNC1069’s operations have matured beyond targeting cryptocurrency‑focused organizations, extending into the wider financial ecosystem where access to capital, investment data, and transactional infrastructure provides higher‑value opportunities. Recent reporting shows the group shifting toward environments that rely heavily on remote communication, allowing their AI‑generated impersonation and deepfake‑based social engineering to blend seamlessly into everyday business workflows. This pivot demonstrates a broader strategic intent: to compromise institutions that manage large financial movements, possess sensitive funding insights, or serve as gateways into additional high‑value networks. 

Targets Identified in Recent Activity 

• Cryptocurrency, DeFi, and FinTech organizations remain primary targets due to their high‑value digital assets and reliance on browser‑based workflows. 

• Venture capital and investment firms are increasingly targeted as attackers exploit trust‑based communication to impersonate executives and influence financial decisions. 

• Video conferencing and messaging platforms serve as key entry points, providing ideal conditions for deepfake‑driven impersonation and ClickFix‑style malware delivery. 

Defensive Considerations for Financial Organizations 

Financial institutions face elevated risk as UNC1069 blends AI‑driven impersonation, deepfake‑enhanced interactions, and user‑initiated malware delivery. Defenses must emphasize identity assurance, endpoint visibility, and human‑focused detection, with careful attention to social engineering that occurs over real‑time communication platforms—not just email. 

Actions Relevant to Mitigating These Tactics 

• Use phishing‑resistant, hardware‑based authentication to prevent account compromise even if attackers harvest credentials or session tokens. 

• Train employees to spot AI‑generated deception, including odd video behavior, audio mismatch, or unusual “troubleshooting” requests during calls. 

• Enhance macOS monitoring and EDR visibility to detect keychain access, browser manipulation, and unauthorized extension activity tied to UNC1069 tools. 

Conclusion 

UNC1069’s recent activity highlights how quickly threat actors are using AI to enhance social engineering, automate intrusions, and conceal malware within routine business interactions. As deepfake impersonation and AI‑generated dialogue become more convincing, financial organizations must strengthen security by adopting phishing‑resistant authentication, improving macOS monitoring, limiting externally prompted command execution, and training employees to detect AI‑driven deception. By hardening these controls, institutions can better defend against the next wave of AI‑powered cybercrime.