Threat Actor 🇰🇵 North Korea
UNC1069
Also known as: MASAN · CryptoCore
CryptoCore is a North Korean APT known for targeting cryptocurrency exchanges and financial institutions, employing spear-phishing techniques that lead to LONEJOGGER malware infections. The group has leveraged social engineering tactics, including deepfake technology and hijacked YouTube accounts, to execute sophisticated giveaway scams that deceive victims into sending cryptocurrencies. Their operations have involved the misuse of platforms like Gemini for reconnaissance and the development of fraudulent content. Additionally, CryptoCore has been linked to a variety of campaigns, including Dangerous Password and SnatchCrypto, focusing on financial gain through cryptocurrency theft.
Indicators of Compromise 11
MITRE ATT&CK TTPs 8
Source Articles
Cloud Threat Highlights: H1 2026
In H1 2026, a surge in cloud-based threats was driven by aggressive software supply-chain attacks, particularly by the group TeamPCP, which compromised developer toolchains across npm, PyPI, and VSCode extensions to steal credentials and propagate across cloud environments. TeamPCP's malware evolved to exploit CI misconfigurations, extract OIDC tokens, and deploy wipers with Dune-themed taunts. North Korea's UNC1069 conducted parallel campaigns, trojanizing the axios package and compromising over 140 @mastra-related packages. The open-sourced Shai-Hulud worm enabled follow-on attacks like IronWorm, which used Rust-based binaries and eBPF rootkits for stealth. A new extortion group, JINX-0163, emerged, targeting cloud identities across AWS, Azure, and GCP to steal secrets and enable ransom threats via the alias 'FulcrumSec'.
wiz
Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet
Amazon Threat Intelligence attributes the September 2025 compromise of the npm packages debug and chalk to the North Korean threat actor Sapphire Sleet, also linked to prior attacks on axios and typo-crypto. The attacks began with social engineering of maintainers, followed by malicious updates containing trojanized code. The debug and chalk incident involved a browser-side interceptor that hijacked cryptocurrency transactions by rewriting wallet addresses, while other campaigns used post-install hooks and command-and-control infrastructure. Amazon ties the campaigns together through shared tradecraft, code reuse, and overlapping C2 indicators, though some technical discrepancies exist in the evidence.
hacker-news ·4w ago