Threat Actor Profiles

UNC1069

1 briefing · first covered 4/10/2026 · last covered 4/10/2026

Indicators of Compromise

Subscribe to unlock this actor's full IOC list

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Attribution & Known Techniques

Matched to UNC1069 in MISP's open threat-intelligence galaxy.

Country: North Korea

No technique-level data in the matched source for this actor.

Coverage Timeline

4/10/2026 · ACTIVE CAMPAIGN

North Korea Hid 1,700 Malicious Packages Inside Your Dev Team's Tools

Socket Security has documented 1,700+ malicious packages tied to North Korea's Contagious Interview campaign across five package ecosystems. Separately, UNC1069 compromised the Axios npm maintainer via social engineering, injecting a backdoor into a library present in an estimated 80% of cloud environments. Here's the full attack chain, WAVESHAPER.V2 IOCs, and what to do now.

Not yet tracked for this actor

  • CrowdStrike Falcon / SentinelOne Deep Visibility-specific query syntax — hunting queries above (if any) are Microsoft Defender/Sentinel KQL
  • File transfer and exfiltration services used
  • Hunting queries — no FalconFriday rule matched this actor's known techniques
UNC1069: Threat Actor Profile | Decryption Digest | Decryption Digest