UNC1069
No sourced public emblem in this profile.
reference profile · reported nexus: KP (not nationality)
CryptoCore is a North Korean APT known for targeting cryptocurrency exchanges and financial institutions, employing spear-phishing techniques that lead to LONEJOGGER malware infections. The group has leveraged social engineering tactics, including deepfake technology and hijacked YouTube accounts, to execute sophisticated giveaway scams that deceive victims into sending cryptocurrencies. Their operations have involved the misuse of platforms like Gemini for reconnaissance and the development of fraudulent content. Additionally, CryptoCore has been linked to a variety of campaigns, including Dangerous Password and SnatchCrypto, focusing on financial gain through cryptocurrency theft.
Source-reported aliases: MASAN, CryptoCore, MIDNIGHT NEPTUNE. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://www.mandiant.com/resources/blog/north-korea-cyber-structure-alignment-2023
https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools/
https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/