North Korean cybercriminals have deployed a wave of new malware in a campaign to collect data for future cryptocurrency heists, using artificial intelligence (AI) to impersonate a crypto executive, according to security researchers.

The campaign, attributed to a DPRK-linked cybercrime group tracked as UNC1069, used a variety of trademark North Korean tactics to perpetrate a highly targeted attack, the Google-owned cybersecurity firm Mandiant said in a report published Tuesday.

UNC1069 — active since 2018 and also known as MASAN — has a long history of targeting financial services and virtual currency firms specializing in payments, brokerage, staking and