UNC1069 Uses Fake Meetings to Deploy Cross-Platform RATs and Capture Victim Media

Apr 16, 2026 · Original article ↗

Summary

Validin details UNC1069 fake-meeting lures against crypto and Web3 targets, browser-based audio/video capture, and Windows, macOS and Linux payload chains deploying apparent updated Cabbage RAT variants and, on macOS, a sample identified as NukeSped.

Key points

The article describes UNC1069, a North Korean actor, using fabricated venture-capital personas and LinkedIn or Telegram outreach to lure cryptocurrency and Web3 professionals into fake meetings.
Fake meeting pages imitate Zoom, Google Meet or Microsoft Teams and use ClickFix prompts or purported SDK and driver updates to persuade victims to run commands.
A JavaScript sample requests microphone and camera access, streams media using WebRTC and a WebSocket signaling channel, and can record it locally for potential reuse in social engineering.
The reported payload chains use Windows PowerShell and VBS, macOS Mach-O or Perl, and Linux ELF downloaders to retrieve additional components; the malware appears to include updated Cabbage RAT variants.
A Windows VBS variant adds Startup-folder persistence and Chrome-extension enumeration; the article says this could help identify cryptocurrency wallet extensions.
The macOS downloader removes quarantine attributes and applies ad-hoc signatures. A downloaded Mach-O RAT is classified by current detections as NukeSped.
Researchers used DNS pivots and lookalike-domain searches to identify infrastructure, while noting that naming-pattern matches require validation before being linked to the campaign.

Article Details

Attack Vectors: UNC1069 uses fabricated venture-capital personas and out-of-band contact through LinkedIn and Telegram to build rapport with cryptocurrency and Web3 professionals, then sends meeting-scheduling links.
Victims are directed to attacker-controlled meeting pages impersonating Zoom, Google Meet, or Microsoft Teams. ClickFix prompts and fake missing-SDK or driver-update messages pressure them to execute commands or downloaders.
Browser JavaScript requests microphone and camera access, streams media over WebRTC/WebSocket, and can record it locally for later social engineering.
OS-specific downloaders retrieve secondary payloads: PowerShell and VBS on Windows, Mach-O or Perl on macOS, and ELF on Linux. Reported payloads include Cabbage RAT variants and NukeSped.
The Windows VBS variant can persist through a shortcut in the Startup folder, collect host data and running processes, and enumerate Chrome extensions. The Linux RAT also collects and exfiltrates host telemetry.
Defensive Notes: Verify meeting links and the meeting provider’s domain through a trusted channel before joining; the article reports attacker-controlled pages impersonating legitimate meeting services.
Do not paste or execute terminal commands from meeting troubleshooting prompts, or install purported meeting SDKs or drivers from those pages.
Review unexpected browser microphone and camera permission requests, particularly on pages reached through unsolicited meeting invitations.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`meet[.]googleapps[.]eu[.]org`	Listed as an example attacker-controlled lookalike meeting domain.
DOMAIN	`web05meet[.]us`	Listed as an attacker-controlled fake meeting domain used in the campaign.
DOMAIN	`zoom[.]05ukweb[.]uk`	Attacker-associated fake meeting domain; the article identifies it as the WebSocket media relay and C2 domain.
DOMAIN	`zoom[.]us07-web[.]us`	Attacker-controlled infrastructure used by a macOS downloader to retrieve payloads and beacon.
DOMAIN	`zoom[.]web05meet[.]us`	Listed as an example attacker-controlled lookalike meeting domain.
IPV4	`104[.]168[.]143[.]111`	Listed as infrastructure hosting campaign C2 or payloads.
IPV4	`108[.]174[.]198[.]11`	Listed as infrastructure hosting campaign C2 or payloads.
IPV4	`144[.]172[.]114[.]220`	Listed as infrastructure hosting campaign C2 or payloads.
IPV4	`144[.]172[.]116[.]9`	Listed as infrastructure hosting campaign C2 or payloads.
IPV4	`23[.]254[.]167[.]21`	Listed as infrastructure hosting campaign C2 or payloads.
IPV4	`45[.]61[.]129[.]29`	Listed as infrastructure hosting campaign C2 or payloads.
IPV4	`45[.]61[.]157[.]248`	Attacker infrastructure embedded in a Perl downloader and used to retrieve payloads.
SHA256	`0ed9a9b7923df0bad0be9ac7fe8ecb6a669715823f892d034b8d07ce9e0aa164`	Hash of the second PowerShell downloader.
SHA256	`1c715cd40331ba2ca6559d2fdb958e7f44053080f9ffd3d90bd1916978d336cb`	Hash of the first Mach-O downloader.
SHA256	`48db089cf31488bcf0493e9deda3d21272c57f3be4f9031febda915f19191cdc`	Hash of a Perl downloader used in the macOS infection chain.
SHA256	`5cdec83048aba45a5a635f470c602c0f29fadeef5d3d5e7dc88291b1588b8dcc`	Hash of a VBS Cabbage RAT payload.
SHA256	`755cc133ae0519accbcfdd5f8f0d9fe1aa08cbcb306c3e5f29ebcb6ac12d9323`	Hash of the macOS application file distributed in the campaign.
SHA256	`8445652beedba94a586e23bfc6af49d98d76845d178314212058258e68e51500`	Hash of the first PowerShell downloader.
SHA256	`8976e76450bfb8af45f3c9ebc24a8f6a3df912d87a10b5625774fa6aace7fc19`	Hash of a second VBS Cabbage RAT payload.
SHA256	`ac38fb51937c123a7a52da7243ec2d25c8120158c31dc94bcd94e8935513f7b7`	Hash of the Mach-O RAT identified by current VirusTotal detections as NukeSped.
SHA256	`c19133aaae9f1b3fc184e7b56c6e6adef4cb4a7961061d66d1dbbc4d7a492bcd`	Hash of the ELF downloader.
SHA256	`d60d079774cd05f11640ee7789256ed68a74fba1bbbf0f5201c6e174a9cb3bbd`	Hash of the ELF Cabbage RAT payload.
SHA256	`eaa63d074eb82c5d798b944e7e2b6ead1617508c8413845a81ba5ebd08a00b93`	Hash of a ZIP archive containing the macOS application distributed in the campaign.
SHA256	`f3478504e9a0ce76eec51b656db835b661fe7df41cacf76a14cbc26fc705bbb1`	Hash of a Perl RAT payload.
URL	`hxxps[:]//zoom[.]05ukweb[.]uk:3000`	Specific attacker-controlled WebSocket endpoint used to relay captured audio and video.