Circuit Wire — a daily news update from the Circuit.
On November 12, the Justice Department and FBI announced they had disrupted cloud-based infrastructure behind FaceStealer, a North Korean social engineering scheme that officials say stole more than $400 million in cryptocurrency over the past 18 months. The FBI Los Angeles Field Office and the U.S. Attorney's Office for the Central District of California led the action. Under a federal warrant, the FBI also seized more than 900 webcam videos of FaceStealer victims.
The scheme starts with a meeting request. The attackers send Calendly invitations to Zoom or Microsoft Teams calls from accounts stolen from earlier victims, The Record reported, so the invitation appears to come from a known contact. Once the target joins, the attackers record the target's webcam while playing prerecorded video of a previous victim or a trusted contact. In some cases they used AI-generated deepfakes of well-known figures in cryptocurrency and Web3.
The attackers then claim a technical fault, often that the target cannot be heard, and offer a link or prompt to fix it. That fix installs malware. According to The Record, the tools include a browser cookie harvester, keyloggers, screen capture and a backdoor. The recorded webcam footage is later reused to deceive the victim's own contacts. The Justice Department said the attackers also mined contact lists, social media and messaging apps, and in some cases struck months, or more than a year, after the first compromise.
Patrick Grandy, who leads the FBI Los Angeles Field Office, said the scheme "exploits our trust in ubiquitous video conference platforms and valued personal relationships."
The department said the attackers are increasingly targeting open-source software developers and maintainers to reach their devices and software repository accounts, which it said appears aimed at software supply-chain attacks. The Record reported attempts against maintainers of npm packages and Rust crates. The FBI attributes FaceStealer to the group known in the private sector as APT38, Sapphire Sleet, BlueNoroff and Stardust Chollima, among other names.
The same announcement covered a separate case. The department obtained court authorization to seize or restrain more than $1.2 billion in cryptocurrency stolen from the Binance exchange on or about October 29, in a theft of more than $6 billion that the FBI has attributed to North Korean actors known as TraderTraitor. An FBI agent told The Record it is unclear whether FaceStealer played a role in that breach. No criminal charges were announced. The FBI has published a report on the technique and a FaceStealer resource page.
Want a weekly roundup of the major stories shaping the security industry? The On The Circuit newsletter is read by more than 12,000 protection professionals.
Spotted something we should cover? Send tips and feedback via circuit-magazine.com.