DPRK AI misuse: IT worker bulk LLM API registration; MIDNIGHT NEPTUNE (formerly UNC1069) AI-enabled cryptocurrency theft

Google Threat Intelligence Group (GTIG) / Google Cloud

Notably, GTIG has observed at least one DPRK IT worker threat cluster engaging in bulk LLM API registration using hijacked accounts, in order to scale their operations. ... MIDNIGHT NEPTUNE, financially motivated North Korea-nexus threat clusters formerly tracked as UNC1069, have increasingly integrated AI across their operational lifecycles to support cryptocurrency theft.