FBI disrupts crypto theft scheme by North Korean hacking group; billions stolen so far - Los Angeles Times
The FBI and Department of Justice have disrupted a sophisticated cryptocurrency theft scheme by a North Korean hacking group, seizing over 900 webcam recordings of victims and halting an operation that stole more than $400 million.
The FBI announced on Thursday that it has disrupted a cloud-based infrastructure used by a North Korean hacking group, resulting in the seizure of more than 900 webcam videos of victims working in the cryptocurrency and Web3 industries worldwide.
The hackers, who have aggressively targeted people in the cryptocurrency and Web3 industries as well as workers in the development and maintenance of open-source software, managed to steal more than $400 million over an 18-month period before the disruption.
The FBI attributes this activity to the North Korean hacking group commonly referred to in the private sector as Sapphire Sleet, UNC1069, Stardust Chollima, APT38, and BlueNoroff.
North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft.
The hackers used a sophisticated social engineering scheme dubbed "FaceStealer" to compromise victims. The scheme involves hijacking LinkedIn, Telegram, Slack and Discord accounts of people known to the victim, then impersonating those people to make contact and lure the victims into video calls using Zoom, Microsoft Teams and Google Meets.
As the victim waits for the call to start, the hackers secretly record them to impersonate them later. Once the call starts, the impersonator attempts to persuade the victim to download malware, often under the guise of resolving a technical issue.
The FBI stated that the hackers' objective is compromise of the software supply chain. By infiltrating accounts of trusted developers and maintainers, the threat actors can potentially distribute malicious code through widely used software, impacting millions of downstream users.
Broader crypto thefts
Separately from the FaceStealer scheme, members of the North Korean military, referred by the FBI as "TraderTraitor," stole more than $6 billion in cryptocurrency from the world’s largest crypto exchange Binance on Oct. 29, according to federal authorities.
Binance said it has replaced the stolen assets to its customers, but not recovered the stolen loot. Federal authorities said they have worked closely with private companies to recover the stolen funds, freezing more than $2.7 million and obtaining court approval to seize or restrict access to $1.2 billion of that amount.
FBI officials said efforts to trace, freeze, seize and forfeit the stolen virtual assets are ongoing. Additionally, the agency put out a flash alert on its website to inform the public of the FaceStealer campaign.
Related
