UNC1069
UNC1069 is a North Korea-attributed cybercrime syndicate with a financial motive, tracked by Brandefense. It targets 5 sectors, including Government and Technology, in 3 countries, including the United States and South Korea. It uses 10 MITRE ATT&CK techniques.
- MASAN
- CryptoCore
- MIDNIGHT NEPTUNE
- Origin
- North Korea
- Techniques
- 10
- Exploited CVEs
- No CVE data
- Record updated
Who They Target.
About UNC1069.
CryptoCore is a North Korean APT known for targeting cryptocurrency exchanges and financial institutions, employing spear-phishing techniques that lead to LONEJOGGER malware infections. The group has leveraged social engineering tactics, including deepfake technology and hijacked YouTube accounts, to execute sophisticated giveaway scams that deceive victims into sending cryptocurrencies. Their operations have involved the misuse of platforms like Gemini for reconnaissance and the development of fraudulent content. Additionally, CryptoCore has been linked to a variety of campaigns, including Dangerous Password and SnatchCrypto, focusing on financial gain through cryptocurrency theft.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.