FBI: North Korean hackers used secretly recorded videos to steal over $400 million in crypto
The FBI says a North Korean hacking group lured victims to fake video calls, recorded their webcams, and used the footage to hijack accounts and steal cryptocurrency.
By John Ferrari ·
North Korean state-backed hackers have stolen more than $400 million in cryptocurrency over the past 18 months by secretly recording images of their victims and then using that material to go after the victims' contacts, the FBI said in an advisory on Wednesday.
The bureau calls the social engineering scheme "FaceStealer." Under the operation, targets receive invitations to video chats hosted on imposter versions of popular meeting platforms, including Zoom, Microsoft Teams and Google Meet.
The invitations appear legitimate because they come from genuine contacts the victims have previously interacted with. Those contacts, however, have had their social media and communication accounts compromised, and their images have been secretly recorded without their knowledge.
Once a target joins the fraudulent call, where they are also being recorded, they are presented with a mock technical error. The supposed fix requires clicking a link, which then infects the target's computer and social media accounts.
From there, the cycle repeats itself. The newly compromised accounts and the contacts attached to them are used to target additional people, allowing the scheme to spread from one victim to the next.
According to the advisory, the FBI has identified and seized more than 900 victim webcam videos connected to the campaign.
The bureau also warned that the hackers have begun using artificial intelligence to create deepfake videos of well-known and influential figures in the cryptocurrency and blockchain industries, adding a new layer of sophistication to their operations.
The FBI attributed the activity to a cluster of North Korean hackers tracked as "Sapphire Sleet," also known as UNC1069. The group is separate from the North Korean hackers that the FBI and private industry have linked to the recent $6.3 billion hack of the cryptocurrency exchange Binance.
