The US Department of Justice has seized cloud infrastructure used by North Korean hackers in a video scam that stole more than $400 million in cryptocurrency over 18 months.
This is reported by DW.
The Federal Bureau of Investigation calls the scam “Facestealer”.
Hackers are known to have sent meeting invitations from accounts taken over from previous victims. After a victim joins, the hackers record video from their own webcam and play back a pre-recorded clip of a previous victim the target knows.
This makes it appear that trusted contacts are present. The FBI says the hackers have also begun using AI-generated deepfakes of prominent figures in the crypto world.
The hackers then stage a fake technical error and offer a link to “fix” it, which installs malware, the agency said. In some cases, they waited months or more than a year before stealing funds.
After that, they use the victim’s contacts to find new targets.
According to the agency, most targets work in the cryptocurrency sector and other internet-related industries. The hackers are also increasingly choosing open-source software developers as victims—likely to carry out supply-chain attacks.
Under a federal warrant, the FBI seized more than 900 webcam videos showing victims.
The FBI links “FaceStealer” to a hacking group known as Sapphire Sleet or UNC1069. This group is not connected to the North Korean military hackers accused of stealing funds from the Binance exchange.
It is known that the US Justice Department has court approval to seize or detain more than $1.2 billion stolen during the attack on Binance.
In the Binance case, the FBI said the group known as TraderTraitor stole more than $6 billion—this happened around 29 October. The incident is described as the largest cryptocurrency theft in history.
North Korea denies involvement in the Binance hack.