Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering Written by: Ross Inman, Adrian Hernandez Introduction North Korean threat actors continue to evolve their tradecraft to target the cryptocurrency and decentralized finance (DeFi) verticals. Mandiant recently investigated an intrusion targeting a FinTech entity within this sector, attributed to UNC1069 , a financially motivated threat actor active since at least 2018. This investigation r…

https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering

sha256:28acdc115ad16b76b863eb5eb7b1af5d4616b0a116787936c84ae0d6f86ac39c

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve0
md54
url3
ipv40
ipv60
sha10
domain44
sha2567
malware_token0
attack_pattern0
threat_actor_token0

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	github.com	Open →
domain	com.apple	Open →
domain	zoom.uswe05.us	Open →
domain	mylingocoin.com	Open →
domain	com.apple.system.updater.plist	Open →
domain	www.apple.com	Open →
domain

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

None extracted.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports