FBI Disrupts North Korean Deepfake Crypto Theft Scheme - BankInfoSecurity

The social engineering campaign, dubbed FaceStealer by the FBI, is attributed to a Pyongyang group known as BlueNoroff, Sapphire Sleet or Stardust Chollima. The group has specifically targeted the cryptocurrency and Web3 industries, stealing at least $400 million in cryptocurrency through malware and artificial intelligence-powered lures over the past 18 months.

The same threat actor is also responsible for a series of open-source software supply chain attacks in recent months, poisoning packages associated with artificial intelligence framework Mastra and JavaScript and Python libraries. The group exploits access gained from a single compromised maintainer to reach a wider pool of downstream victims.

Attack Method

FaceStealer attackers start by sending a message to a previously compromised victim's contact, asking to catch up or discuss a past conversation on Zoom or Teams. The calendar invite link they provide is typosquatted and leads to an attacker-controlled video conference platform made to look like the real applications.

During the video call, attackers play a recording of someone the victim knows, captured during an earlier fraudulent call. They feign audio problems and instruct the victim to click a link to update their device, which downloads malware. This malware scans the victim's device for valuable access like cryptocurrency wallets and seed phrases, gains access to social media accounts and contacts, and secretly records webcam video.

The FBI has seized over 900 victim webcam videos from the threat actor's cloud storage. The current estimate of financial loss from FaceStealer is based only on victims the FBI could identify, and the agency has established a website for potential victims to come forward.

Separate Operations

Although the FaceStealer group and the TraderTraitor group behind the Binance attack share the goal of funneling stolen cryptocurrency to the North Korean regime, FBI officials confirmed the two schemes and threat actors are separate operations. Both, however, relied on third-party supply chain compromises to gain initial access.

Binance attackers poisoned a version of Homebrew, a third-party package manager for macOS, causing a Binance wallet infrastructure engineer to download the tampered version because it appeared in search results instead of the legitimate installer. A senior Department of Justice official announced that the government has recently frozen $2.7 billion and obtained authorization to seize another $1.2 billion from the $6.3 billion worth of cryptocurrency stolen from Binance.