North Korean UNC1069 hackers use AI deepfakes in crypto firm attacks
North Korea-linked UNC1069 hackers attacked cryptocurrency and fintech companies using AI-generated deepfake video feeds in fake Zoom calls, deploying seven malware families to extract sensitive data. The campaign represents a tactical escalation by the group, which has been active since 2018 and uses AI to increase credibility during social engineering attacks.
What happened
North Korea-linked threat actors tracked as UNC1069 escalated social engineering attacks against cryptocurrency and fintech companies using AI-generated deepfakes. The campaign deployed seven malware families including SILENCELIFT, DEEPBREATH and CHROMEPUSH to harvest sensitive data and access digital assets.
Attackers compromised Telegram accounts and staged Zoom meetings featuring deepfake video feeds. In one case, they gained access to a crypto founder's Telegram account to contact another target, inviting them to a Zoom meeting where an attacker posed as someone experiencing audio issues and instructed the victim to run embedded commands that initiated the infection chain.
Reported impact
The malware toolkit included data-mining strains designed to bypass operating system components and extract personal and system-level data. The campaign targeted cryptocurrency companies, software developers and venture capital firms, according to Mandiant's report.
Index analysis
Mandiant noted that advances in AI have enabled UNC1069 to scale its tactics since the group was first tracked in 2018. Google Threat Intelligence Group reported in November 2025 that the actor introduced 'AI-enabled lures in active operations' for the first time, with deepfake video calls representing a tactical refinement that increased credibility during the compromise stage.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.