DPRK UNC1069 fake meeting / Teams phishing domains
- Scam type: Phishing
- Reported: 2026-10-14
- Last updated: 2026-10-16
Domains attributed by the Security Alliance (SEAL) to UNC1069, a DPRK-linked intrusion set using fake meeting invites / fake Teams calls to compromise crypto users. SEAL weekly report 2026-10-06 listed 7 new high-confidence UNC1069 domains (teampcsoft.com, teamscloud.us.com, teannslives.com, teans-lives.com, teensliwe.com, us05cloud.co, us05cloud.live) and noted a $86.7K key compromise; SEAL weekly report 2026-10-13 listed UNC1069 phishing infrastructure teamoftenuse.com, teanrisliue.com, tearns-liue.com and an older C2 server tied to new deployments, check02id.com (plus IP 188.227.197.143),…
Websites in this report: teampcsoft.com, teamscloud.us.com, teannslives.com, teans-lives.com, us05cloud.co, us05cloud.live, teamoftenuse.com, teanrisliue.com, tearns-liue.com, check02id.com