FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls - The Hacker News
North Korean hackers have stolen over $400 million in cryptocurrency through a sophisticated social engineering scheme called FaceStealer, using deepfake video calls to target cryptocurrency and Web3 professionals.
The U.S. Federal Bureau of Investigation (FBI) has confirmed that threat actors tied to North Korea have stolen more than $400 million worth of cryptocurrency through a sophisticated social engineering campaign codenamed FaceStealer over the last 18 months. In response, the U.S. government has seized the cloud-based infrastructure used to execute this "hard-to-detect" campaign.
Deepfake Deception
The FaceStealer scheme relies on surreptitiously recorded videos and deepfakes to facilitate cryptocurrency theft. North Korean hackers use super intelligence to develop deepfake videos of influential individuals in the cryptocurrency and Web3 industries, making the scheme highly effective. The campaign is linked to the BlueNoroff threat cluster, also known by cryptonyms APT38, UNC1069, and others.
North Korean cyber actors have used the FaceStealer scheme to aggressively target individuals in the cryptocurrency and Web3 sectors through deceptive social engineering tactics, resulting in the theft of more than $400 million in the last 18 months.
Attack Mechanics
The attack begins with hackers compromising a victim's cryptocurrency wallets, seed phrases, and communication accounts. They then impersonate the victim and send meeting invitations to their contacts. When targets join the fake Zoom or Teams meeting, attackers play prerecorded videos or deepfakes of trusted contacts to build trust.
A few seconds into the meeting, victims are presented with a mock technical error and provided a malicious link to fix the non-existent issue. This ClickFix-style lure installs malware on the victim's workstation, enabling theft of cryptocurrency and abuse of their computer privileges. The attack then propagates to the victim's contacts, creating a self-sustaining cycle.
Expanding Threat
The campaign has expanded significantly since its inception, with 677 targets identified across 58 countries. Over 80% of targets are founders and C-suite executives in the cryptocurrency and blockchain finance sectors. The hackers have incorporated generative AI technology from ChatGPT, Google, and other platforms to create convincing synthetic participant videos and artwork.
Arctic Wolf reports that BlueNoroff specifically targets individuals with access to cryptocurrency assets, wallet infrastructure, exchange platforms, or investment decision-making authority. The campaign has also been used to target software developers and maintainers, as demonstrated when the maintainer of the popular Axios npm package was compromised to push a trojanized version.
The Department of Justice has additionally announced the seizure of more than $1.2 billion worth of cryptocurrency stolen by North Korean-linked hackers from Binance, which the regime uses to fund its illicit weapons program. The FBI has seized over 900 victim webcam video recordings used in these attacks and is aware of ongoing attempts to target software developers and maintainers.
Related
