North Korean state-backed hackers steal over $400 million in cryptocurrency, FBI says

As part of a social engineering scheme, which the FBI refers to as “FaceStealer,” targets are lured to video chats on imposter versions of video meeting software such as Zoom and Microsoft Teams.

North Korean state-backed hackers have stolen more than $400 million in cryptocurrency over the past 18 months using surreptitiously recorded images of people which are then used to target their contacts, the FBI said Thursday.

As part of a social engineering scheme, which the FBI refers to as “FaceStealer,” targets are lured to video chats on imposter versions of video meeting software such as Zoom, Microsoft Teams, and Google Meet.

The targets are issued invitations from genuine contacts they have previously interacted with, but whose social media and communication accounts have been compromised and whose images have been secretly recorded.

Once on the call, the targets - who are also being recorded - encounter a mock technical error which requires a fix by clicking a link, which then infects the target’s computer and social media accounts.

The target’s contacts are then used to target additional people.

The FBI has identified and seized more than 900 victim webcam videos, according to Wednesday’s advisory.

Hackers using AI for deepfakes of well-known people, FBI says

Hackers are starting to use artificial intelligence to create deepfake videos of well-known and influential people in the cryptocurrency and blockchain industries, the FBI said.

The FBI attributed the activity to a cluster of North Korean hackers known as “Sapphire Sleet” or UNC1069, a separate group from the North Korean hackers linked by the FBI and private industry to the recent $6.3 billion hack of cryptocurrency exchange Binance.