Justice Department Announces Actions to Disrupt North Korea’s Massive Theft of Cryptocurrency - Van Nuys News Press

The Department of Justice has announced coordinated actions against North Korea's government schemes to fund its regime through massive cryptocurrency theft. These actions include the seizure of cloud-based infrastructure used in the FaceStealer social engineering scheme that has resulted in the theft of more than $400 million worth of cryptocurrency and the court-authorized seizure of more than $1.2 billion worth of cryptocurrency recently stolen from Binance.

North Korea's government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft, according to Principal Deputy Assistant Attorney General for National Security M. Scott Proctor. "Today's announcement shows that America will fight back against that corrupt regime's effort to profit through cybercrime."

FaceStealer Scheme Disrupted

The U.S. Attorney's Office for the Central District of California announced the disruption of cloud-based infrastructure used by North Korean hackers in a highly effective social engineering scheme called "FaceStealer." The scheme relies on surreptitiously recorded videos and artificial deepfakes, resulting in the theft of more than $400 million in the last 18 months.

North Korean hackers known publicly by names including Sapphire Sleet, UNC1069, and BlueNoroff have lured targets with invitations to video meetings from stolen accounts. Once a target joins, the hackers record their webcam video and play prerecorded videos of previous victims, simulating participation of trusted contacts to gain trust.

During the meeting, hackers introduce fake technical errors and provide links that install malware on the target's computer. With access compromised, they can steal cryptocurrency or exploit the target's infrastructure to other computer systems. In some cases, thefts occurred months or even years after initial compromise.