FBI disrupts North Korea’s FaceStealer crypto theft scheme

The FBI said Thursday that it had disrupted cloud infrastructure used in "FaceStealer," a North Korean scheme that uses fake video calls and secretly recorded webcam footage to target people who work in cryptocurrency. According to the Justice Department, the scheme has stolen more than $400 million over the past 18 months, and the FBI used a federal warrant to seize more than 900 webcam videos of victims.justice.gov

The FBI linked the activity to North Korean state-sponsored hackers tracked under names including Sapphire Sleet, UNC1069, APT38 and BlueNoroff, according to an FBI flash alert. Reuters reported that this cluster is separate from the North Korean hackers blamed for last month's $6.3 billion theft from the crypto exchange Binance.rmb.reuters.com+1

How the trap works

Invitations come from real accounts that the hackers took over from earlier victims. Those accounts are on services such as Telegram, LinkedIn Microsoft Corporation ↗ 0.36% and Slack Salesforce, Inc. ↘ 0.20%, according to Nextgov. The links lead to imitation versions of Zoom ↘ 0.39%, Microsoft Teams and Google Meet Alphabet Inc. ↗ 1.62%, Reuters reported. Once the target joins, the hackers play prerecorded video of contacts the target knows and record the target's own webcam. In some cases they have also used AI to make deepfakes of well-known crypto figures.nextgov.com+2

Next, a fake technical error appears, such as a claim that the target's audio is not working. The suggested "fix" installs keyloggers, screen capturers, a cookie harvester and a backdoor, The Record reported. "This is not something we can patch," Jeremy Robertson, special agent in charge of the FBI's Los Angeles field office, told reporters, calling the scheme "very, very convincing".therecord.media+1

Open-source software targeted

The FBI warned that the hackers are going after open-source software maintainers as well as crypto workers. Several attempts have been aimed at maintainers of packages on the NPM JavaScript registry and of Rust crates. Officials said one developer's computer was compromised and malicious code was added to widely used software, but the attack was caught before it spread far.nextgov.com+1

Separate Binance seizure

In a separate action on the same day, the Justice Department got court authorization to seize or restrain more than $1.2 billion stolen from Binance. That amount is part of about $2.7 billion frozen after the hack. The FBI has blamed that theft on the North Korean group TraderTraitor, and an FBI agent said it is unclear whether FaceStealer played any part in it. North Korea has denied involvement in the Binance hack. Kim Yo Jong called the accusations "a trite provocation".thehill.com+1

"If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough," FBI official Patrick Grandy said of FaceStealer.therecord.media