Mandiant Report: UNC1069 Targets Crypto Sector with AI-Enabled Social Engineering
UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering
Threat Intelligence Analysis: Mandiant (Google Cloud)
A recent investigation by Mandiant has exposed a sophisticated campaign by the North Korean-nexus threat actor UNC1069. This financially motivated group, active since 2018, has intensified its focus on the cryptocurrency and decentralized finance (DeFi) sectors. The campaign is notable for its use of AI-generated deepfakes and a highly tailored infection chain designed to harvest credentials and browser data from high-value targets.
By leveraging compromised social media accounts and fake video conferencing software, UNC1069 successfully deployed a suite of seven new malware families onto victim systems, signaling a significant evolution in North Korean cyber tradecraft.
The Social Engineering Ruse: From Telegram to Deepfakes
The attack begins not with a technical exploit, but with a high-trust social engineering lure. The threat actors utilize compromised Telegram accounts belonging to executives within the cryptocurrency industry to initiate contact with potential victims.
The Fake Zoom Meeting
Once rapport is established, the attacker invites the victim to a 30-minute meeting via a Calendly link. This link redirects to a spoofed Zoom meeting page hosted on infrastructure controlled by the adversary (e.g., zoom[.]uswe05[.]us). Highlights of this stage include:
- AI-Enabled Deception: Victims reported joining the call and seeing a video of a well-known cryptocurrency CEO. Mandiant reports that this was likely an AI-generated deepfake designed to validate the legitimacy of the meeting.
- The "ClickFix" Tactic: To initiate the malware download, the attackers feign "audio issues." They instruct the victim to run a "troubleshooting command" in their terminal to fix the sound. This command is actually a malicious string that kiks off the infection chain.
A Suite of Seven: The New Malware Families
Mandiant's analysis of the intrusion revealed an unusually high volume of unique tooling deployed on a single host. The seven malware families identified include:
| Malware Family | Role in Attack Chain | Primary Function |
|---|---|---|
| WAVESHAPER | Initial Backdoor | Packed backdoor that serves as the primary conduit for follow-on payloads. |
| HYPERCALL | Downloader | Facilitates the deployment of additional modules and persistence mechanisms. |
| HIDDENCALL | Secondary Backdoor | A follow-on component to HYPERCALL used for persistent remote access. |
| SUGARLOADER | Loader | A known downloader used to execute final-stage data exfiltrators. |
| DEEPBREATH | Data Miner (Swift) | Targets the macOS Keychain, Apple Notes, and Telegram databases. |
| SILENCELIFT | Information Stealer | Designed to capture host environment data and system metadata. |
| CHROMEPUSH | Browser Stealer | Specifically harvests cookies, saved logins, and session tokens from Chrome, Brave, and Edge. |
Post-Exploitation: Manipulating the TCC Database
One of the more advanced techniques observed in this campaign involves the DEEPBREATH malware. To bypass macOS security restrictions, the malware targets the Transparency, Consent, and Control (TCC) database:
- Staging: It renames the user's TCC folder and moves the
TCC.dbfile to a temporary location to avoid live-system conflicts. - Injection: The malware programmatically inserts new permissions into the database, granting itself access to the Desktop, Documents, and Downloads folders.
- Restoration: The modified database is moved back to its original location, giving the malware full file system access without prompting the user for permission.
Mitigation and Recommendations
"The deployment of seven unique families on a single host demonstrates a highly determined effort to ensure total visibility into the victim's digital life." — Mandiant Intelligence
Mandiant recommends that organizations in the Web3 space adopt the following defenses:
- Verify via Secondary Channels: Always confirm meeting requests through a second, trusted communication channel if the request involves running scripts or downloading software.
- Hardware-Based MFA: Utilize FIDO2 security keys to protect against credential harvesting and session token theft.
- Endpoint Monitoring: Monitor for suspicious terminal commands, especially those involving the manipulation of
TCC.dbor unexpectedcurlrequests to unfamiliar domains.
