FBI cracks down on North Korean FaceStealers as $400M stolen
The campaign lured victims into fake meetings.
N. Korean hacker silhouette with North Korean flag. Bill Hinton/Getty.
Follow us
- The FBI says North Korean hackers stole more than $400 million in cryptoassets over 18 months.
- The FaceStealer campaign used fake video meetings, stolen webcam clips, impersonation, and malware.
- Investigators seized more than 900 webcam videos from victims in crypto and open-source software.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
In another alleged campaign attributed to North Korean hackers, criminals managed to steal more than $400 million in cryptoassets over the past 18 months, the FBI said, announcing countermeasures.
According to the FBI, the campaign, called FaceStealer, involved fake video meetings, stolen webcam recordings, impersonation, and malware designed to compromise victims' computers.
Investigators now claim they have seized more than 900 webcam videos recorded from victims in the cryptoasset industry and among open-source software developers around the world.
According to the FBI, the attackers also tried to compromise the open-source software supply chain.
Separately, the US Department of Justice (DOJ) said it had seized cloud-based infrastructure used by the hackers. Additionally, they also seized more than $1.2 billion worth of cryptoassets stolen from the Binance crypto exchange in October. This theft was also attributed to North Korean hackers.
As explained by the FBI, the attackers behind the FaceStealer campaign lured their victims into fake meetings and then played "prerecorded webcam videos of previous victims to simulate a legitimate video call with participants the target knows."
During these calls, the criminals pretended that a technical problem had occurred and, while impersonating the victim's trusted contact, provided instructions to fix it. As is common with similar fake calls, the "fix" is precisely what installs malware on the victim's computer.
With this malware, cryptoassets could be stolen, or the victim's access to external infrastructure, such as an employer's network, could be exploited.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
The investigation showed that in several cases, the hackers stole assets, hijacked communication accounts, months to over a year after the initial compromise as they were waiting for the balances of cryptoasset wallets to increase.
"If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough," Patrick Grandy, assistant director in charge of the FBI’s Los Angeles Field Office, said, warning that North Korean hackers can deceive "even the most experienced technical and security conscious computer user."
