FBI says North Korean hackers stole US$400m in crypto using fake video calls
The FBI says a scheme it calls FaceStealer used secretly recorded webcam footage of victims to lure their contacts into fake video meetings.
North Korean state-backed hackers have stolen more than US$400 million in cryptocurrency over the past 18 months by luring people into fake video calls, the FBI said, according to The Straits Times and BBC News.
The bureau calls the social engineering scheme "FaceStealer". Targets receive invitations from contacts they already know, whose social media and messaging accounts have been compromised. The calls run on what US authorities described as "imposter versions" of Zoom, Microsoft Teams and Google Meet.
Once the call begins, the BBC reported, the hackers play pre-recorded footage of a previous victim the target knows, and the audio appears to fail. A message then asks the target to "fix" the problem by clicking a link. That link installs malware giving the hackers access to the victim's contact lists and apps. The target is also secretly recorded, and that footage is used to approach the next round of victims.
The two outlets give the scale differently. The Straits Times, carrying a Reuters report, said the FBI had identified and seized more than 900 victim webcam videos, citing an advisory issued on November 10. The BBC reported that more than 900 victims had fallen prey to the scheme.
According to the BBC, authorities say FaceStealer "aggressively targets" people in the cryptocurrency and web3 sectors, particularly those who develop and maintain open-source software. The Straits Times reported the FBI as saying hackers have begun using artificial intelligence to make deepfake videos of well-known figures in the cryptocurrency and blockchain industries.
"The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years," FBI cyber director Brett Leatherman said, as quoted by the BBC.
Patrick Grandy, assistant director in charge of the FBI's Los Angeles field office, said the scheme "exploits our trust in ubiquitous video conference platforms and valued personal relationships". He added: "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough."
The FBI attributed the activity to a North Korean cluster known as "Sapphire Sleet" or UNC1069, The Straits Times reported. It said this group is separate from the hackers linked by the FBI and private industry to the recent US$6.3 billion theft from Binance. The BBC reported that Binance, the world's largest crypto exchange, said a week earlier that hackers had used fake job interviews in that attack. US agencies have attributed it to North Korea-linked actors. Pyongyang has denied the claim.
Sources: The Straits Times, North Korean hackers steal more than US$400 million using video images, FBI says; BBC News, North Korean hackers used fake video calls in $400m crypto hack, says FBI.
