Christina Lekati

"Proven play? Replay".

This is not a one time hit. Mandiant has observed UNC1069 using these techniques to target both corporate entities and individuals within the cryptocurrency industry, as well as venture capital firms and their employees or executives. The list will expand.

🔸 Embedded within the string of commands is a single command that initiates a multi-stage infection chain, ultimately deploying 7 distinct malware families (described in the report).

🔸 And then hey, "the audio is broken!". If only that could quickly get fixed...there are only 20 minutes left in the call.

This is where the ClickFix-style social engineering begins. The the threat actor directs the victim to run troubleshooting commands on their system to fix the issue.

🔸 The call begins. The victim sees the video of a CEO from another company.

Or, purportedly, their deepfake version.

𝘉𝘶𝘵, 𝘸𝘩𝘦𝘯 𝘢 𝘵𝘩𝘳𝘦𝘢𝘵 𝘢𝘤𝘵𝘰𝘳 𝘵𝘢𝘬𝘦𝘴 𝘵𝘩𝘦 𝘵𝘪𝘮𝘦 𝘵𝘰 𝘣𝘶𝘪𝘭𝘥 𝘵𝘳𝘶𝘴𝘵 𝘸𝘪𝘵𝘩 𝘢 𝘵𝘢𝘳𝘨𝘦𝘵 𝘧𝘪𝘳𝘴𝘵, 𝘵𝘩𝘦 𝘵𝘳𝘶𝘴𝘵-𝘵𝘳𝘢𝘯𝘴𝘧𝘦𝘳𝘦𝘯𝘤𝘦 𝘮𝘦𝘤𝘩𝘢𝘯𝘪𝘴𝘮 𝘬𝘪𝘤𝘬𝘴 𝘪𝘯. 𝘈𝘯𝘥 𝘵𝘩𝘦𝘯, 𝘵𝘩𝘦 𝘭𝘪𝘵𝘵𝘭𝘦 𝘳𝘦𝘥 𝘧𝘭𝘢𝘨𝘴 𝘵𝘩𝘢𝘵 𝘧𝘰𝘭𝘭𝘰𝘸 𝘵𝘦𝘯𝘥 𝘵𝘰 𝘨𝘦𝘵 𝘰𝘷𝘦𝘳𝘭𝘰𝘰𝘬𝘦𝘥. 𝘈𝘴 𝘵𝘩𝘦𝘺 𝘥𝘪𝘥.

🔸 The Calendly link redirects to a spoofed Zoom meeting hosted on the threat actor's infrastructure: zoom[.]uswe05[.]us

𝘛𝘩𝘪𝘴 𝘪𝘴 𝘵𝘩𝘦 𝘧𝘪𝘳𝘴𝘵 𝘰𝘣𝘷𝘪𝘰𝘶𝘴 𝘳𝘦𝘥 𝘧𝘭𝘢𝘨 𝘵𝘩𝘢𝘵 *𝘤𝘰𝘶𝘭𝘥* 𝘩𝘢𝘷𝘦 𝘣𝘦𝘦𝘯 𝘴𝘱𝘰𝘵𝘵𝘦𝘥.

𝐖𝐡𝐚𝐭 𝐡𝐚𝐩𝐩𝐞𝐧𝐞𝐝?

🔸 The threat actor initiates contact with a specific victim via Telegram, using a legit but compromised account of an executive,leverageing existing trust.

🔸 After building rapport through industry-specific conversation, they invite the victim to a call & send a Calendly link.

UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering | Google Cloud Blog North Korean threat actors target the cryptocurrency industry using AI-enabled social engineering such as deepfakes, and ClickFix.

If you think AI and deepfakes are THE name of the game in "sophisticated" social engineering attacks, think again. AI-gen deepfakes are often just one step (a final blow) in a larger social engineering kill-chain.

In this week's SE case, we see a layered intrusion.

cloud.google.com/blog/topics/...

You will learn how to conduct an in-depth digital investigation on a subject, discover new leads, uncover and utilize all the evidence that are hiding in plain sight (and beyond) & conduct virtual HUMINT in an uncomplicated, step-by-step process.
P.S. There will be a class challenge, and a reward :)

Join @osintgeek.de and me on the 21st & 22nd of April for two days full of learning, hands-on exercises, real life case studies and the latests developments in #OSINT #SOCMINT and #HUMINT.

𝐎𝐮𝐫 "𝐅𝐮𝐧𝐝𝐚𝐦𝐞𝐧𝐭𝐚𝐥𝐬 𝐨𝐟 𝐂𝐲𝐛𝐞𝐫 𝐈𝐧𝐯𝐞𝐬𝐭𝐢𝐠𝐚𝐭𝐢𝐨𝐧𝐬 𝐚𝐧𝐝 𝐇𝐮𝐦𝐚𝐧 𝐈𝐧𝐭𝐞𝐥𝐥𝐢𝐠𝐞𝐧𝐜𝐞" 𝐜𝐥𝐚𝐬𝐬 𝐢𝐬 𝐫𝐞𝐭𝐮𝐫𝐧𝐢𝐧𝐠 𝐭𝐡𝐢𝐬 𝐬𝐩𝐫𝐢𝐧𝐠 𝐭𝐨 @blackhatevents.bsky.social 𝐀𝐬𝐢𝐚 𝐢𝐧 𝐒𝐢𝐧𝐠𝐚𝐩𝐨𝐫𝐞! 🎉

For details & registrations:
blackhat.com/asia-26/trai...

Aim for less detail in what can be visible, even through crowdsourced images.

🔹 Prioritize based on risk and take practical steps to implement better security measures on those vulnerable, identified spots before an adversary exploits them.

May the odds ever be in our favor ✨️

What can be done? If you work on securing a critical infrastructure entity:

🔹 Run your own OSINT analysis to identify vulnerabilities in advance. Know your level of exposure.

Control what you can:
🔹 Where possible, ask platforms to add blur or remove certain imagery.

It is scary easy for saboteurs or other attackers to find vulnerabilities on critical infrastructure free & available online, and to focus on the locations/points where an attack could have the maximum impact.
This incident has not been an isolated event.

There is more publicly available information and databases that can be researched, found, and used in similar acts of sabotage (or worse, given the geopolitical state we are currently in).

The Google street view imagery provides some extra help in reviewing some of the physical security and the surrounding area in preparation of a better plan.
The OpenInfraMap in combination with Google maps is just one simple example of potential adversarial OSINT.

Looking at the OpenInfraMap data in combination with satellite imagery, it is easy to see why this point of attack was chosen: all the 110 Κilovolt high-voltage lines that supply southwest Berlin converge into a single cable bridge that is overground, and easily accessible.

Don't think that searching this map needs to take a lot of time. By using Overpass Turbo (also with the help of with any LLM that it is compatible with) one can significantly trim the search time and concentrate their research through queries.

𝐎𝐩𝐞𝐧𝐈𝐧𝐟𝐫𝐚𝐌𝐚𝐩 (𝐡𝐭𝐭𝐩𝐬://𝐨𝐩𝐞𝐧𝐢𝐧𝐟𝐫𝐚𝐦𝐚𝐩.𝐨𝐫𝐠/) is an open-source web platform that provides a layered, detailed visualization on global infrastructure data like 𝘱𝘰𝘸𝘦𝘳, 𝘵𝘦𝘭𝘦𝘤𝘰𝘮, 𝘰𝘪𝘭 𝘢𝘯𝘥 𝘨𝘢𝘴 𝘯𝘦𝘵𝘸𝘰𝘳𝘬𝘴, 𝘸𝘢𝘵𝘦𝘳 𝘪𝘯𝘧𝘳𝘢𝘴𝘵𝘳𝘶𝘤𝘵𝘶𝘳𝘦 𝘢𝘯𝘥 𝘮𝘢𝘫𝘰𝘳 𝘳𝘢𝘪𝘭 𝘱𝘰𝘸𝘦𝘳 𝘴𝘺𝘴𝘵𝘦𝘮𝘴 𝘪𝘯𝘧𝘳𝘢𝘴𝘵𝘳𝘶𝘤𝘵𝘶𝘳𝘦 (data is crowdsourced from OpenStreetMap).

How did they know to set on fire one specific bridge that contained 5 high-voltage and 10 med-voltage cables,causing a major power outage?
Can one find enough information on a city's power grid infrastructure available online?

Yes,they can. With more detail than there should be.

Berlin was faced with a 2nd arson attack on their power grid within a few months, leaving thousands of households without power, for days. Several systems were damaged simultaneously deeming any backup systems, ineffective.
An attack like this requires some reconnaissance.
🧵

Adversarial Misuse of Generative AI | Google Cloud Blog We share our findings on government-backed and information operations threat actor use of the Gemini web application.

Report by Google (government-backed threat actor use of the Gemini): cloud.google.com/blog/topics/...

Detecting and Countering Malicious Uses of Claude Detecting and Countering Malicious Uses of Claude

2 additional reports on how GenAI has been used in social engineering attacks. They provide a more holistic understanding on how these tools are being used by adversaries:

Report by Anthropic (Claude): www.anthropic.com/news/detecti...

🔹 I know that some of you in my network (and some of our clients) had to deal with the attacks documented. This will hit home.

🔹 Ultimately, we can use this report help us further improve our defense strategies with reality in mind.

🔹 The operations described in the report help give us a better understanding of how threat actors are *realistically* trying to abuse GenAI models. No guesses, no fancy assumptions, just the observed TTPs.

Disrupting malicious uses of AI: June 2025 Our latest report featuring case studies of how we’re detecting and preventing malicious uses of AI.

3 resources in 1 post:
Open AI has released a new report outlining the ways in which threat actors used their generative AI products to support their social engineering attack operations. They provide the case studies.

openai.com/global-affai...

Why is this useful? 🧵

Happy news!! This September at @brucon we will be taking a deep dive into #socialengineering and #OSINT through a 3-day, hands-on training class!
I SO look forward to it and to meeting the participants!! 🤩👩🏻‍💻

Full class content & details: www.brucon.org/training-det...

Always fun hanging out with you @cyber.coffee! 🙌🏻

Very grateful for last week spent at X33fcon in Poland!
It started with 2 days full of #socialengineering & #OSINT training where I had the privilege to teach a class that was present, curious, and ready to try things out.
Big bonus: reconnecting with friends during the conference days afterwards😊

When AI Goes Rogue: How Agentic AI Will Reshape Social Engineering Attacks Cyber criminals are rarely late to the game when it comes to new technologies. In fact, they’re often among the first ones to experiment…

Agentic AI has opened new frontiers for adversaries looking to automate and scale attacks.

I wrote an article explaining what Agentic AI really is & how it can shape the future of the social engineering threat landscape.

christina-lekati.medium.com/when-ai-goes...