FBI disrupts North Korean FaceStealer scheme behind $400M crypto theft via hijacked meetings and fake videos
The FBI and DOJ have disrupted a North Korean cyberattack campaign named FaceStealer, responsible for stealing over $400 million in cryptocurrency over 18 months. The attackers, linked to groups like UNC1069 and APT38, hijack messaging accounts on platforms such as Telegram, Slack, LinkedIn, and Discord to invite targets to fake Zoom or Teams meetings. These meetings use prerecorded webcam footage and fabricated participants to convince victims to execute malicious commands, installing malware that steals browser cookies, logs keystrokes, captures screenshots, and grants persistent access. They often wait months before stealing cryptocurrency while monitoring wallets. The campaign also targets open-source software maintainers, attempting to insert malicious dependencies into widely used libraries. FBI seized over 900 webcam videos and reports emerging use of AI-generated videos to impersonate individuals in the cryptocurrency sector. This campaign reflects a broader trend of North Korean attacks targeting cryptocurrency and software supply chains.
Linha do tempo
-
FBI disrupts North Korean FaceStealer scheme behind $400M crypto theft via hijacked meetings and fake videos
ler a análise desta fonte ocultar
The FBI and DOJ have disrupted a North Korean cyberattack campaign named FaceStealer, responsible for stealing over $400 million in cryptocurrency over 18 months. The attackers, linked to groups like UNC1069 and APT38, hijack messaging accounts on platforms such as Telegram, Slack, LinkedIn, and Discord to invite targets to fake Zoom or Teams meetings. These meetings use prerecorded webcam footage and fabricated participants to convince victims to execute malicious commands, installing malware that steals browser cookies, logs keystrokes, captures screenshots, and grants persistent access. They often wait months before stealing cryptocurrency while monitoring wallets. The campaign also targets open-source software maintainers, attempting to insert malicious dependencies into widely used libraries. FBI seized over 900 webcam videos and reports emerging use of AI-generated videos to impersonate individuals in the cryptocurrency sector. This campaign reflects a broader trend of North Korean attacks targeting cryptocurrency and software supply chains.