UNC1069

A financially motivated North Korean actor active since at least 2018 and focused on cryptocurrency and Web3 organizations. It uses relationship-building social engineering, compromised messaging accounts, fake meetings, ClickFix, malware, and increasingly AI-assisted deception to steal digital assets and sensitive information.