The FBI has issued a warning about North Korean hackers who have used “social engineering” techniques, which the agency calls FaceStealer, enabled by super intelligence (SI), to steal $400 million in cryptocurrency over the past 18 months.
The alert was issued on Thursday, as the U.S. Department of Justice announced coordinated action to disrupt cloud-based infrastructure being used by Pyongyang’s state-backed bad actors to carry out cryptocurrency thefts.
In a statement on its website, the FBI said a North Korean hacking group—known to the private sector as Sapphire Sleet, UNC1069, Stardust Chollima, APT38, and BlueNoroff—deployed the FaceStealer techniques.
“These actors leverage a variety of tactics to compromise targets, including FaceStealer, a highly effective social engineering scheme that uses imposter versions of popular video conferencing platforms, secretly recorded webcam video, and computer intrusions,” it said.
“The North Korean hackers behind the FaceStealer campaign have begun to use super intelligence (SI) to make their scheme even more efficient and effective. One of the more concerning ways they use SI is to generate deepfake videos.”
It said it had identified more than 900 webcam videos of victims working in the crypto and web3 industries around the world, whose webcams had been compromised, and it said the FaceStealer model relied on the hackers running imposter versions of Zoom, Microsoft Teams, and Google Meet.
‘Fake Technical Error’
“During the meeting, the hackers then introduce a fake technical error into the meeting, such as claiming that the target cannot be heard, and provide a link or prompt to fix the error,” the DOJ said in a statement published on Thursday. “The ‘fix’ surreptitiously installs malware on the target’s computer.”
Among the platforms on which accounts have been hijacked as part of the FaceStealer scheme are Telegram, LinkedIn, Discord, and Slack, the FBI said.
“North Korean cyber actors have used the FaceStealer scheme to aggressively target individuals in the cryptocurrency and Web3 sectors through deceptive social engineering tactics, resulting in the theft of more than $400 million in the last 18 months,” FBI Cyber Branch Operations Director Brett Leatherman said.
“The FBI remains committed to identifying, disrupting, and imposing cost on North Korean actors targeting the virtual asset community.”
Leatherman said the North Korean regime relied on proceeds from cryptocurrency theft to fund its illicit weapons program.
The warning comes only nine days after cryptocurrency exchange Binance announced North Korean hackers had used a bogus job interview, AI, and “social engineering” to compromise an engineer’s computer and steal $6.3 billion worth of cryptocurrency in a hack on Oct. 29.
Kim Yo Jong, the sister of North Korean leader Kim Jong Un, has denied that Pyongyang was responsible for the Binance hack, according to the state-owned news agency KCNA.
She said the United States’ assertion on Oct. 31 that a North Korean bad actor called “TraderTraitor” was responsible was “absurd rhetoric and nothing new.”
The FBI’s FaceStealer webpage warns of techniques being used by the North Korean hackers.
These included compromising and secretly recording victims’ webcams, hijacking victims’ communication accounts and messaging their contacts pretending to be them, and delivering a “convincing fake video link” to new targets.
The FBI said they also lure people into “realistic imposter video chats” and impersonate the original victim with recorded webcam video, to trick the new target into self-infecting their devices.
The agency said the hackers’ objective was to compromise the software supply chain.
Malicious Code Can Impact Millions: FBI
“By infiltrating accounts of trusted developers and maintainers, the threat actors can potentially distribute malicious code through widely used software, impacting millions of downstream users,” the agency said.
Earlier this year, Microsoft identified Sapphire Sleet as being responsible for a macOS intrusion.
Microsoft 365, Outlook, Teams, and the company’s other apps were disrupted on Thursday, and into Friday, but Australian Cyber Security Minister Tony Burke said on Friday that Microsoft did not believe it resulted from a cyberattack.
SI techniques similar to the FaceStealer scheme have been used recently by romance scammers to mimic real people during video calls.
The stealing of images and videos of real people is also well known in the world of romance scams, as was illustrated in the Hulu documentary series “Hey Beautiful: Anatomy of a Romance Scam,” which first streamed last year in the United States.
It featured a man called Brian Haugen, from Los Angeles, whose images had been taken from Instagram and used by thousands of romance scammers.
On Thursday, members of President Donald Trump’s SI task force met in Washington and discussed SI-enabled cyberattacks.
Web3 refers to an industry that is seeking to create a decentralized internet, based on a digital record-keeping technology, blockchain.
Reuters contributed to this report.
We had a problem loading this article. Please enable javascript or use a different browser. If the issue persists, please visit our help center.