FBI Disrupts North Korean FaceStealer Campaign Linked to $400M Crypto Theft and Binance Heist
The U.S. Justice Department and FBI have dismantled the cloud infrastructure behind FaceStealer, a North Korean state-sponsored social engineering campaign responsible for stealing over $400 million in cryptocurrency in the last 18 months. FaceStealer operators, linked to groups such as Sapphire Sleet (APT38) and UNC1069, hijacked legitimate Telegram, Slack, LinkedIn, and Discord accounts to trick contacts into joining fake video calls, where they employed stolen webcam footage to impersonate trusted colleagues. Victims were then socially engineered into executing malicious scripts that installed cookie harvesters, keyloggers, screen capture tools, and backdoors, facilitating long-term wallet thefts. The FBI’s FLASH advisory recommends verifying call hosts, using official app invitations, and refraining from pasting commands during meetings. In a parallel operation, the FBI attributes thefts of about $6 billion from Binance to the North Korean military-aligned threat actor TraderTraitor and has helped freeze and seize significant stolen assets. The campaign also targeted open-source JavaScript package maintainers via fake Teams calls to insert malicious dependencies, but early detection prevented compromise. Victims are urged to secure wallets, use multifactor authentication on messaging apps, warn contacts, and report incidents to IC3.gov.
Linha do tempo
-
FBI Disrupts North Korean FaceStealer Campaign Linked to $400M Crypto Theft and Binance Heist
ler a análise desta fonte ocultar
The U.S. Justice Department and FBI have dismantled the cloud infrastructure behind FaceStealer, a North Korean state-sponsored social engineering campaign responsible for stealing over $400 million in cryptocurrency in the last 18 months. FaceStealer operators, linked to groups such as Sapphire Sleet (APT38) and UNC1069, hijacked legitimate Telegram, Slack, LinkedIn, and Discord accounts to trick contacts into joining fake video calls, where they employed stolen webcam footage to impersonate trusted colleagues. Victims were then socially engineered into executing malicious scripts that installed cookie harvesters, keyloggers, screen capture tools, and backdoors, facilitating long-term wallet thefts. The FBI’s FLASH advisory recommends verifying call hosts, using official app invitations, and refraining from pasting commands during meetings. In a parallel operation, the FBI attributes thefts of about $6 billion from Binance to the North Korean military-aligned threat actor TraderTraitor and has helped freeze and seize significant stolen assets. The campaign also targeted open-source JavaScript package maintainers via fake Teams calls to insert malicious dependencies, but early detection prevented compromise. Victims are urged to secure wallets, use multifactor authentication on messaging apps, warn contacts, and report incidents to IC3.gov.