Loading threat actor…
Midnight Neptune, also tracked as UNC1069, is a financially motivated threat actor assessed to be linked to North Korea. Its operations support cryptocurrency theft. The group has used commercial large language models and locally deployable open-weight models to support social engineering, manipulate software supply chains, and develop automated backdoors. This use of AI is intended to accelerate and scale operational activity across cryptocurrency-focused intrusion campaigns.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.