DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

UNC1069 (4)

Events whose actors field, as written by the source, names this.

Date (as written)IncidentCountryActors
2025-11-05 (datePublished)UNC1069 (MASAN) misuse of Gemini and deepfake lures distributing BIGMACHOUNC1069 (aka MASAN)
2026-04ZerionUnited StatesUNC1069
2026-02-09 (datePublished)UNC1069 intrusion at a FinTech entity using compromised Telegram account, fake Zoom meeting and deepfakeUNC1069
03/04/2026Node.js ecosystem maintainers (Socket CEO, Platformatic CTO, Dotenv creator, Node.js Security WG, and others)GlobalUNC1069 (North Korean state-linked)