FBI disrupts intricate North Korean fake-call scheme tied to $400M in crypto theft - Nextgov/FCW
The FBI has dismantled an elaborate North Korean hacking operation that used recorded videos of victims to impersonate them in online meetings, stealing over $400 million in cryptocurrency.
The operation, dubbed FaceStealer, tricks victims into joining fake video calls with what appear to be familiar contacts, then installing malicious software disguised as a fix for an audio problem. Hackers use this access to steal funds, take over accounts, and approach the victim's contacts.
Authorities seized cloud infrastructure used in the campaign and more than 900 webcam videos of victims. The FBI also revealed that hackers compromised a developer maintaining widely used software, adding malicious code before the attack was detected and stopped.
Impersonation Tactics
FaceStealer builds on existing victim relationships. Hackers send invitations through compromised accounts on Telegram, LinkedIn, Slack, and Discord. Access to previous conversations allows attackers to make their messages appear authentic, directing targets to websites mimicking Zoom or Microsoft Teams.
Developer Targeting
The campaign specifically targeted developers who maintain open-source software used by other organizations. Earlier this year, a JavaScript library maintainer fell victim after joining a fake Teams meeting and following instructions that infected their computer.
Meanwhile, the Justice Department announced court authorization to seize over $1.2 billion stolen from Binance during a $6.3 billion theft last month. The funds are part of a larger recovery totaling $2.7 billion, though the process of returning them to rightful owners remains unclear.
Related
