North Korean state-backed hackers have stolen more than $400 million in cryptocurrency over the past 18 months, the FBI said on Thursday. They used secretly recorded videos of people to trick those people's contacts, Reuters reported. The FBI calls the scheme "FaceStealer".
The trick starts with an invitation from a real contact whose social media or messaging account has already been hacked. The target is invited to a video call on an imposter version of Zoom, Microsoft Teams or Google Meet. According to the BBC, the hackers then play pre-recorded video of the contact to make the call look genuine.
During the call, the audio appears to fail. A message asks the target to "fix" it by clicking a link. The link installs malware that gives the hackers access to the victim's computer, contact lists, apps and social media accounts. The new victim is also secretly recorded, and that footage is used to target the next round of people.
The FBI said it has identified and seized more than 900 victim webcam videos, Reuters reported. The BBC, citing the bureau, said more than 900 victims had fallen prey to the scheme. US authorities say FaceStealer "aggressively targets" people in the cryptocurrency and web3 sectors. Those who build and maintain open-source software are especially at risk. The FBI also said hackers are starting to use artificial intelligence to make deepfake videos of well-known figures in the crypto and blockchain industries.
FBI cyber director Brett Leatherman said the North Korean regime relies on large-scale cryptocurrency theft to fund its weapons programme. He said it has stolen billions of dollars in recent years. Patrick Grandy, who heads the FBI's Los Angeles field office, said the scheme exploits trust in video conference platforms and personal relationships. "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough," he said.
The FBI linked the activity to a cluster of North Korean hackers known as "Sapphire Sleet" or UNC1069. Reuters reported that this group is separate from the hackers blamed for the recent $6.3 billion hack of the crypto exchange Binance. According to the BBC, Binance revealed a week ago that hackers had used fake job interviews in that theft. US law enforcement agencies attributed the Binance hack to North Korea-linked actors. Pyongyang has denied the claim.