Anas SahelIdentity & security

Threat watch / Threat actors

BlueNoroff

State-linked updated 12 Nov 2026

North Korean hackers who target cryptocurrency holders and, increasingly, open-source developers, according to the US Justice Department, which lists the names Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima for them.

Also known as
Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, Stardust Chollima
Attribution

On November 12, 2026, the US Justice Department attributed the FaceStealer social engineering campaign (fake video meetings, deepfakes, malware disguised as a fix) to "North Korean hackers" known publicly by these names, and said it led to the theft of more than $400 million in the last 18 months. [1]

Incidents in the watch

  1. FaceStealer: North Korean fake video calls with deepfakes stole more than $400M Critical

← All threat actors