FBI says North Korean hackers use deepfakes to target crypto investors and developers

A North Korean group lures victims into fake Zoom and Teams video meetings, where the “interlocutor” is secretly recorded video of someone they know. The FaceStealer scheme brought hackers more than $400 million in 18 months and is now targeting open-source software developers.

The U.S. Federal Bureau of Investigation warned of a social-engineering scheme through which North Korea-linked hackers have stolen more than $400 million in cryptocurrency over the past 18 months. The FBI calls it FaceStealer: attackers secretly record victims through their webcams and then use those recordings to deceive people they know.

A call with no one on the other end

The attack begins with a hacked Telegram or LinkedIn account. A calendar invitation to a meeting is sent to the victim in the account holder’s name. FBI Special Agent Jeremy Robertson said the link leads to a domain containing an intentional typo. The victim lands on a fake copy of Zoom, Microsoft Teams or Google Meet. “You will see the face of the friend or partner who invited you, you will see them looking around and moving their lips, but you will not hear any sound,” Robertson said.

A message then appears in the chat saying that the other person cannot hear the victim and that the program needs to be updated. The “fix” installs malware that steals cryptocurrency and sends the hackers a list of contacts. Meanwhile, the new victim’s webcam secretly records them, and their face becomes bait for the next wave of attacks. The U.S. Department of Justice said that in some cases, the theft or takeover of accounts occurred months or even more than a year after the infection.

North Korean flag on a flagpole

Deepfakes and open source

The FBI said the group known as Sapphire Sleet, UNC1069, APT38 and BlueNoroff has begun using AI-generated deepfakes of prominent figures from the cryptocurrency and Web3 sectors to make meetings more convincing. “North Korean hackers are increasingly combining computer intrusions, social engineering and emerging technologies such as deepfakes,” said Brett Leatherman, an FBI cyber official.

Developers and maintainers of open-source software have become a new target. By gaining access to their devices and repositories, hackers can inject malicious code into software used by large numbers of people. U.S. prosecutors assessed that this choice of targets “appears to be aimed at software supply-chain attacks.”

Souvenir bitcoin coin in a hand

Under a court order, the FBI took down the scheme’s cloud infrastructure and seized more than 900 recordings of victims. “All the victims were experienced executives and developers in the cryptocurrency and Web3 sectors, and even cybersecurity specialists,” Robertson stressed. The same day, the U.S. Department of Justice said it had arrested or frozen more than $1.2 billion out of the $6.3 billion stolen on October 29 from the Binance exchange by another North Korean group, TraderTraitor.

Photo: social media, Wikimedia Commons

FBI says North Korean hackers use deepfakes to target crypto investors and developers