The FaceStealer scheme used hijacked messaging accounts, fake video meetings and secretly recorded webcam footage to target cryptocurrency holders and open-source maintainers.
The US Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI) have disrupted cloud infrastructure used by North Korean hackers in a campaign that stole more than $400 million in cryptocurrency over the past 18 months.
The FBI calls the operation FaceStealer. It involves hijacked messaging accounts, fake video meetings and prerecorded webcam footage of people known to the targets. The attackers use these meetings to convince victims to run malicious commands on their computers.
How the FaceStealer Attacks Work
The FBI links the activity to North Korean hackers known by several names, including UNC1069, APT38, BlueNoroff and Sapphire Sleet. According to the agency’s flash notice (PDF), the attackers first gain access to someone’s communication account, often on Telegram, Slack, LinkedIn or Discord.
They then contact people in that person’s network and invite them to a Zoom or Microsoft Teams meeting. The meeting link leads to a fake website that looks like the real service.
In the fake meetings, hackers play webcam recordings of people the target knows, sometimes adding fabricated participants to make the call more convincing. Then, they pose as those contacts and claim there is a problem with the meeting, such as an audio issue.
The target is asked to run a script, click an update link or paste commands into a terminal. Doing so installs malware that can collect browser cookies, log keystrokes, capture screenshots and give the hackers continued access to the computer.
The compromise does not always lead to an immediate theft. The FBI found cases in which North Korean hackers waited months, sometimes more than a year, before taking cryptocurrency, monitoring victims’ wallet balances in the meantime.
The bureau seized more than 900 webcam videos used to impersonate victims. It also warned that attackers have started using AI-generated videos of well-known figures in the cryptocurrency industry, although recordings of real victims remain the main method.
Developers Also Targeted
The operation is not limited to people holding cryptocurrency. The FBI says the hackers have increasingly approached open-source software developers and maintainers to get access to their computers and repository accounts.
In one case, attackers compromised the maintainer of a widely used JavaScript library and attempted to add malicious dependencies. The library receives tens of millions of downloads each week. The attempt was detected before the attackers could use it to distribute the malicious code widely.
Hackread.com previously reported on UNC1069 targeting Node.js maintainers through fake LinkedIn and Slack profiles. The latest FBI advisory provides further details about how these approaches can be used to reach software projects through their maintainers.
The latest development comes amid growing concerns over North Korean cyberattacks targeting the cryptocurrency industry. In a recent attack on Binance, hackers linked to North Korea’s TraderTraitor group stole approximately $6.3 billion in cryptocurrency. The attackers reportedly used fake job interviews and malicious coding assignments to compromise developers and gain access to the exchange’s internal systems.
