daily cyber × ai intelligence

← threat actors

threat actor · KP

UNC1069

also tracked as citrine sleet 1, cryptocore 1, famous chollima 1, jade sleet 1, lazarus group 1, moonstone sleet 1, temp hermit 1

1 story · 0 in the wild · September 9, 2026 – September 9, 2026

evidence: none

sectors

  • crypto 1 · Sep 9
  • defense 1 · Sep 9
  • finance 1 · Sep 9
  • government 1 · Sep 9

geography

  • north korea 1 · Sep 9

what we reported, newest first, grouped by story

September 9, 2026

  • The Lazarus umbrella has been decomposed into six clusters. Kudelski Security and Sekoia map DPRK cyber capability onto TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet and Famous Chollima following a reorganization of the North Korean intelligence service two years ago, mixing espionage with crypto theft, ransomware and bank heists, and place each in the state structure (Kudelski Security). · Sep 9 · none · as lazarus group, temp hermit, citrine sleet, cryptocore, jade sleet, moonstone sleet, famous chollima · Threat Activity