Researcher Links North Korean Hackers to $400 Million Crypto Theft - www.tokenpost.com
U.S. authorities have disrupted a social-engineering operation linked to North Korean hackers that stole over $400 million in cryptocurrency from industry workers over 18 months.
The operation, identified by researcher Jeremy Robertson, involved hijacking Telegram or LinkedIn accounts of industry contacts to send fake meeting invitations. Targets were directed to counterfeit Zoom or Teams calls controlled by the attackers.
Impersonation Tactics
Organizers secretly recorded targets' cameras, then used a previous victim's video to impersonate the meeting's inviter. Fake attendees and claims that the other side couldn't hear the target added psychological pressure.
The campaign relied on impersonating trusted contacts through familiar workplace meeting tools.
Malware Installation
Attackers displayed fake error messages and persuaded targets to run a supposed update that installed malware. This compromise allowed access to computers, crypto wallets and social accounts of experienced professionals in crypto, Web3 or cybersecurity.
Scale of Operation
The FBI reported finding and blocking recordings involving more than 900 victims. The sophisticated operation highlights the growing threat of state-sponsored cyberattacks targeting the cryptocurrency industry.
Related
