Google Threat Intelligence Group (GTIG) / Google Cloud
UNC1069 (MASAN) misuse of Gemini and deepfake lures distributing BIGMACHO · 2025-11-05 (datePublished)
In recent operations, UNC1069 (aka MASAN) used Gemini to research cryptocurrency concepts, and perform research and reconnaissance related to the location of users’ cryptocurrency wallet application data. ... GTIG recently observed the group leverage deepfake images and video lures impersonating individuals in the cryptocurrency industry as part of social engineering campaigns to distribute its BIGMACHO backdoor to victim systems.