US seizes North Korean hacking infrastructure, $1.2 billion in cryptocurrency stolen from Binance - CyberScoop
The US Department of Justice has seized North Korean hacking infrastructure and $1.2 billion in cryptocurrency stolen from Binance, disrupting campaigns that have stolen billions in virtual assets.
The Justice Department announced coordinated actions Thursday against North Korean hacking groups responsible for stealing billions in cryptocurrency. The operation included seizing cloud infrastructure behind a social engineering scheme known as FaceStealer and court-authorized seizure of more than $1.2 billion stolen from cryptocurrency exchange Binance.
The larger operation targets the theft of over $6 billion in virtual assets from Binance, which the FBI attributes to North Korean military hackers called TraderTraitor. Investigators with private virtual asset providers have frozen $2.7 billion of the stolen funds, with courts authorizing seizure of $1.2 billion of that amount.
Before they got beyond law enforcement reach, halting about half of this historic breach.
Sophisticated Social Engineering
The FBI issued an alert detailing how hackers known as Sapphire Sleet, BlueNoroff, APT38 and Stardust Chollima compromise accounts on Telegram, LinkedIn, Slack and Discord. They invite targets to video meetings through links to typo-squatted domains hosting imposter versions of Zoom and Microsoft Teams that are designed by the hackers to be indistinguishable from genuine interfaces.
The seized infrastructure contained a library of more than 900 secretly recorded webcam videos that hackers played to impersonate victims in follow-on attacks. The footage was captured as victims waited for video chats to begin. Because each compromise yields the next victim's video and contacts, the pool of targets "grows exponentially."
Capable of deceiving even the most experienced technical and security conscious computer user. It exploits our trust in ubiquitous video conference platforms and valued personal relationships.
Wider Impact and Response
The campaign has drained over $400 million from cryptocurrency and Web3 sectors in the past 18 months. Earlier this year, hackers used the scheme to lure the maintainer of a significant open-source JavaScript library into a fake Teams meeting, then used access to create malicious dependencies.
North Korea has combined cryptocurrency heists with a scheme to hire remote IT workers at US businesses to launder money and evade sanctions. Despite the seizure, Justin Moore noted a "significant evolution in both the scale and sophistication" of North Korean schemes, though their goal remains the same: exploiting trust to compromise targets.
Related
