The U.S. Department of Justice (DOJ) announced coordinated actions on Thursday to disrupt North Korea’s record-breaking virtual currency theft, including obtaining court authorization to seize over $1.2 billion stolen from cryptocurrency exchange Binance.
The actions target two separate operations attributed to North Korean state-sponsored cybercriminals: a social engineering campaign dubbed “FaceStealer” and the Theft 6.3B in virtual assets from Binance in late October, the DOJ said in a press Realse Thursday.
As part of the FaceStealer operation, the U.S. Attorney’s Office for the Central District of California announced the disruption of cloud-based infrastructure used by North Korean cybercriminals.
Authorities have attributed the activity to North Korean groups publicly tracked under Several names , including Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima.
The social engineering campaign has resulted in the theft of more than $400 million in cryptocurrency over the past 18 months, primarily by targeting individuals in the cryptocurrency and Web3 industries who develop and maintain open-source software.
“The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years,” FBI Cyber Branch Operations Director Brett Leatherman said, according to the press release.
“The FBI remains committed to identifying, disrupting, and imposing cost on North Korean actors targeting the virtual asset community,” he added.
The FBI seized more than 900 webcam videos secretly recorded from victims under a federal warrant, and also released a Public adv detailing how the scheme works on Thursday.
The North Korean actors typically initiate attacks by inviting targets to seemingly legitimate video meetings through platforms such as Zoom and Microsoft Teams, an approach often used... by North Korean cybercriminals to deliver malware.
To establish trust, the attackers play prerecorded webcam footage of people the victims may recognize, according to the advisory.
The cybercrime group also uses artificial intelligence to create deepfake videos of prominent cryptocurrency industry figures in order to deceive targets.
Once a target joins the meeting, the attackers introduce a fabricated technical problem and instruct victims to install an update or run code, secretly infecting their devices with malware and gaining access to cryptocurrency wallets, communications accounts and external networks.
Over the past two years, North Korean cybercriminals have Increasingly employed this tactic, known as “ClickFix,” to deceive unsuspecting victims through fake prompts requesting software patches or updates.
The FBI said perpetrators sometimes waited months or more than a year before stealing cryptocurrency, monitoring wallet balances until they increased. After hijacking earlier victims’ communication accounts, the attackers also used their contact lists and chat histories to identify and approach additional targets.
Beyond direct cryptocurrency theft, the bureau warned that the FaceStealer malware is increasingly being used to target open/Source software developers and maintainers, potentially enabling attacks on Software Supp Chains.
For example, the group compromised the maintainer of a JavaScript library with tens of millions of weekly downloads earlier this year, but the attack was caught before causing widespread harm, the FBI said.
