State-sponsored North Korean hackers have stolen more than US$400 million in cryptocurrency over the past 18 months, using secretly recorded images of individuals, which are then used to target their contacts, the FBI said Thursday.
• As part of a social engineering scheme the FBI calls “FaceStealer,” victims are lured into video calls in fake versions of video conferencing software, such as Zoom, Microsoft Teams and Google Meet.
• Victims receive invitations from real contacts with whom they have previously interacted, but whose social media and communications accounts have been compromised and whose images have been secretly recorded.
• Once on the call, the victims — who are also being recorded — encounter a fake technical error that requires a fix by clicking a link, which in turn infects the victim’s computer and the victim’s social media accounts. The victim’s contacts are then used to reach others.
• The FBI identified and seized more than 900 webcam videos of victims, according to the statement released on Wednesday.
• The hackers are beginning to use artificial intelligence to create deepfake videos of well-known and influential people in the cryptocurrency and blockchain sectors, the FBI said.
• The FBI attributed the activity to a North Korean hacking group known as “Sapphire Sleet” or UNC1069, a group distinct from the North Korean hackers tied by the FBI and the private sector to the recent US$6.3 billion attack on the cryptocurrency exchange Binance.
