State-sponsored hackers from North Korea have stolen more than $400 million in cryptocurrency over the last 18 months using a sophisticated social engineering operation, US authorities announced on November 12. The FBI, which has labeled the campaign "FaceStealer," stated that the attackers successfully targeted more than 900 victims by impersonating trusted contacts.
According to the FBI and the US Department of Justice, the hackers identify targets working in the cryptocurrency and Web3 sectors, with a particular focus on individuals involved in the maintenance and development of open-source software. The attackers utilize social media accounts that have been previously compromised to invite victims to video conferences hosted on imposter versions of platforms like Zoom, Microsoft Teams, and Google Meet.
During these meetings, the hackers play pre-recorded video footage of acquaintances known to the victim to simulate a legitimate interaction. When the audio appears to malfunction, a message prompts the target to click a link to resolve the technical issue. This action triggers the installation of malware, allowing the hackers to access the victim's applications and contact lists, effectively expanding their network for further scams. These malicious actors also secretly record the video calls to create material for future deception.
Key facts
- The "FaceStealer" scheme has resulted in the theft of over $400 million in cryptocurrency over 18 months.
- US authorities report more than 900 individual victims have been affected by this operation.
- Hackers impersonate trusted contacts using imposter versions of Zoom, Microsoft Teams, and Google Meet.
- The FBI attributes this campaign to North Korean state-sponsored actors targeting the Web3 and software development industries.
- The announcement follows a separate incident where hackers allegedly used fake job interviews to steal $6.3 billion from the Binance exchange.
Why it matters
FBI cyber director Brett Leatherman stated that the North Korean regime relies on large-scale cryptocurrency theft to finance its illicit weapons program. US law enforcement officials warned that the scheme is highly effective at exploiting personal relationships and trust in standard video conferencing tools, noting that it can deceive even technologically experienced users.
Background
This disclosure comes just one week after the cryptocurrency exchange Binance reported a record-breaking $6.3 billion theft linked to North Korean actors, a claim that Pyongyang has denied.
Source: BBC, Hindustan Times
Comments