Ledger / Jan 2026
UNC1069 hits crypto fintech with fake Zoom and apparent deepfake CEO video
Strong
Mandiant reports the victim saw an apparent deepfake CEO but could not forensically verify AI model use in that case; it separately reports the group's AI use.
Telegram contact from a compromised executive account led to a spoofed Zoom with an apparent deepfake CEO and a ClickFix lure. Mandiant says the group also uses AI for lure material.
“a video of a CEO from another cryptocurrency company that appeared to be a deepfake”Google Cloud / Mandiant
Sources
- UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social EngineeringGoogle Cloud / Mandiant · 9 Feb 2026 · primary source
- North Korea's UNC1069 Hammers Crypto Firms With AIDark Reading · 11 Feb 2026 · secondary source
- Date
- Jan 2026
- Disclosed
- 9 Feb 2026
- Actor
- UNC1069 (CryptoCore / MASAN) (nation state), as attributed by Google Cloud / Mandiant
- Nexus
- North Korea
- Targets
- Cryptocurrency fintech and Web3 firms, macOS host
- What the AI did
- Deepfake, Social engineering, Phishing content
- Model
- unspecified voice-clone/deepfake tool, Gemini
- Model family
- Deepfake / voice, Google
- Model basis
- stated by researcher
- Autonomy
- assist
- Outcome
- Seven malware families found on a macOS host.