FBI says FaceStealer hackers faked trusted contacts on crypto video calls

North Korean hackers used accounts stolen from previous victims to invite new targets to video calls and played secretly recorded webcam clips of people those targets knew.

The scheme, known as FaceStealer by the FBI, stole more than $400 million in crypto over 18 months, the Justice Department said Thursday.

The department took down FaceStealer’s cloud infrastructure. The FBI also seized more than 900 webcam videos of the scheme’s victims under a federal warrant.

DOJ says a fake audio glitch tricked targets into installing malware

The DOJ said in a release that the crews target people working in crypto and web3. When a target joins, the hackers record that person’s own webcam and play back prerecorded footage of a known contact, faking the presence of a trusted colleague on the call.

The hackers produce deepfake videos of influential people in crypto and web3 with what the department called “super intelligence,” and then run them in the same meetings.

Partway through the call there is a bogus technical fault, for example that the target is not being heard.

Then a link/prompt to “fix” it. It silently installs malware.

Once the computer is hacked, hackers can steal crypto or utilize the target’s access to other systems. In some instances, the theft and account takeovers happened months to over a year after the initial break-in.

Hackers also hunt through each new victim’s contact lists, social media and messaging apps. Personal and professional contacts discovered there become the next targets.

“It exploits our trust in ubiquitous video conference platforms and valued personal relationships. If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough.”

Patrick Grandy, the FBI Los Angeles Field Office’s assistant director in charge, said.

FaceStealer turns on open-source developers as DOJ restrains $1.2 billion

Open source software developers are increasingly targeted. The hackers are targeting their devices and code repository accounts that they control, which the DOJ said appears to be designed to enable supply-chain attacks.

FaceStealer was linked to North Korean groups named Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima, the department said.

In February, Cryptopolitan reported that UNC1069 hijacked a crypto executive’s Telegram account to lure a target into a fake Zoom call. The attackers then feigned audio issues and had the victim run troubleshooting commands.

The FBI put out a report about how the scheme works, including protection steps and advice for victims. It also set up a FaceStealer website as a resource hub.

The DOJ coupled the FaceStealer seizure with another action. It won court approval to seize or restrain more than $1.2 billion that had been stolen from Binance, part of more than $2.7 billion that has been frozen so far.

The department blamed North Korean military hackers it calls TraderTraitor for siphoning more than $6 billion from the exchange around Oct. 29. North Korea has denied any involvement.

“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said M. Scott Proctor, Principal Deputy Assistant Attorney General for National Security.

TraderTraitor is still laundering the Binance funds via crypto bridges, mixers and exchanges. Efforts to trace, freeze, seize and forfeit them continue.

Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.