UNC1069 - DPRK Threat Actor | lazarus.day

UNC1069

2023-04-18 • Mandiant • M-Trends 2023: Cybersecurity Insights From the Fr…

40

Related Actors
18

Related Reports

Related Actors

Jade Sleet

Microsoft

Trader Traitor

First seen: Jul 2023

Last seen: Oct 2024

Trader Traitor

USCISA

Bluenoroff

First seen: Apr 2022

Last seen: May 2026

UNC4899

Mandiant

Trader Traitor

First seen: Jul 2023

Last seen: Mar 2026

T-APT-15

Tencent

Bluenoroff

First seen: Mar 2018

Last seen: Mar 2018

APT38

Mandiant

Bluenoroff

First seen: Oct 2018

Last seen: Nov 2025

Beagle Boyz

USCISA

Bluenoroff

First seen: Aug 2020

Last seen: Mar 2021

Black Alicanto

PWC

Crypto Core

First seen: Sep 2021

Last seen: Apr 2023

Black Dev2

PWC

Bluenoroff

First seen: Sep 2021

Last seen: Apr 2023

Bluenoroff

Kaspersky

First seen: Apr 2017

Last seen: May 2026

Copernicium

Microsoft

APT38

First seen: Nov 2022

Last seen: Nov 2022

UNC785

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Mar 2023

Crypto Core

Clearskysec

Bluenoroff

First seen: Jun 2020

Last seen: Oct 2025

Crypto Mimic

NTTSecurity

Crypto Core

First seen: Sep 2020

Last seen: Feb 2021

UNC786

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Mar 2023

G0082

MITRE

APT38

First seen: Jan 2019

Last seen: Jan 2019

PUKCHONG

Google

UNC4899

First seen: Jun 2024

Last seen: Nov 2025

Leery Turtle

Cyberstruggle

Crypto Core

First seen: May 2020

Last seen: May 2020

Nickel Gladstone

Secure Works

Bluenoroff

First seen: Jun 2021

Last seen: Jun 2021

Dark River

Ptsecurity

Jade Sleet

First seen: Sep 2023

Last seen: Sep 2023

Slow Pisces

Paloalto Networks

Jade Sleet

First seen: Jun 2024

Last seen: Apr 2025

Alluring Pisces

Paloalto Networks

Bluenoroff

First seen: Sep 2024

Last seen: Feb 2025

TA444

Proofpoint

Crypto Core

First seen: Jan 2023

Last seen: Apr 2026

TEMP.Hermit

Fireeye

Bluenoroff

First seen: Mar 2023

Last seen: May 2025

Red Carpet

KRCERT

Bluenoroff

Sector A06

NSHC

Bluenoroff

First seen: Mar 2020

Last seen: Feb 2025

Stardust Chollima

Crowd Strike

Bluenoroff

First seen: Feb 2018

Last seen: Jun 2026

UNC4034

Mandiant

TEMP.Hermit

First seen: Sep 2022

Last seen: Nov 2022

UNC577

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Mar 2023

UNC2970

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Feb 2026

MASAN

Google

UNC1069

First seen: Nov 2025

Last seen: Nov 2025

CTG-6459

Secure Works

Nickel Gladstone

First seen: Jun 2021

Last seen: Jun 2021

Pressure Chollima

Crowd Strike

Jade Sleet

First seen: Jan 2026

Last seen: May 2026

Putrid Slug

Cloudflare

Bluenoroff

First seen: Mar 2026

Last seen: Mar 2026

Sapphire Sleet

Microsoft

Copernicium

First seen: Apr 2023

Last seen: Jun 2026

JINX-0164

Wiz

Sapphire Sleet

First seen: May 2026

Last seen: May 2026

Storm-0954

Microsoft

Jade Sleet

First seen: Apr 2023

Last seen: Apr 2023

TAG-71

Recorded Future

Bluenoroff

First seen: Jun 2023

Last seen: Jan 2024

UNC1758

Mandiant

TEMP.Hermit

First seen: Mar 2023

Last seen: Apr 2023

ATK117

Thales Group

APT38

First seen: Oct 2019

Last seen: May 2022

REF9135

Elastic

Bluenoroff

First seen: Jun 2023

Last seen: Jun 2023

Related Reports

Top Authors

View all reports in this cluster

2026-05-29

SOCRadar

April 2026: ShinyHunters Hits Medtronic and ADT as North Korean Hackers Drain DeFi Protocols

#Lazarus #TraderTraitor #UNC1069 #DriftProtocol #KelpDAO #Axios #NPM #SupplyChain #WAVESHAPER #Trend

2026-05-28

Levelblue

Sapphire Sleet Targets macOS in Multi-Stage Intrusion Campaign

#SapphireSleet #Bluenoroff #UNC1069 #macOS #Cryptocurrency #Phishing #T1059.002 #T1059.004 #T1105 #T1005 #T1560 #T1041 #T1543.004

2026-05-19

OSM

Axios attacker strikes again! Three NPM packages have been hiding in plain sight for two months

#Axios #NPM #UNC1069

2026-04-18

Falcon Feeds

UNC1069: DPRK’s Deepfake-Driven Cyber Campaign Targeting Crypto and Software Supply Chains

#UNC1069 #Deepfake

2026-04-14

Validin

"Hello? I can’t hear you": Investigating UNC1069’s Fake Meeting Tactics

#CabbageRAT #ClickFix #UNC1069

2026-04-08

Security Alliance

Advisory on DPRK (UNC1069) Fake Microsoft Teams and Zoom calls

#UNC1069

2026-04-06

Poly Swarm

The Axios Breach: When npm Trust Becomes an APT Attack Vector

#Axios #NPM #UNC1069

2026-04-01

Cybersec Sentinel

Axios npm Backdoored: UNC1069 Deploys Cross-Platform RAT via Supply Chain Attack

#Axios #NPM #UNC1069 #T1059.007 #T1070.004 #T1036 #T1059.004 #T1547.001 #T1071.001 #T1140 #T1195.002

2026-04-01

Google

North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack

#Axios #NPM #UNC1069 #WAVESHAPER

2026-03-02

Moonlock

Fake VCs target crypto talent

#ClickFix #UNC1069

2026-02-20

Poly Swarm

UNC1069 Uses New Tools to Target Crypto Entities

#ClickFix #UNC1069

2026-02-10

Google

UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering

#UNC1069 #ClickFix #Cryptocurrency #WAVESHAPER

2025-11-05

Google

GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools

#UNC1069 #UNC4899 #MASAN #PUKCHONG #Trend

2025-08-03

划水摸鱼

DRPK Threats to Web3 and Cryptocurrency

#UNC1069 #UNC1720 #UNC4899 #UNC5342 #UNC5267

2025-04-24

Mandiant

M-Trends 2025: Data, Insights, and Recommendations From the Frontlines

#ITWorker #Trend #UNC1069 #UNC3782 #UNC4736 #UNC4899 #UNC5342

View all reports in this cluster