BlueNoroff Uses Fake Zoom Meetings to Target Crypto Executives
Summary
Arctic Wolf reports that BlueNoroff is using fake Zoom meetings, stolen webcam footage and a fake SDK update prompt to target crypto executives, stealing credentials and from crypto wallets; one investigated victim was compromised in under five minutes.
Key points
- Arctic Wolf attributes a financially motivated campaign targeting cryptocurrency executives to BlueNoroff.
- In one investigated case, a Calendly invitation led to a modified calendar event and a typo-squatted Zoom link to a fake meeting lobby.
- The attackers reportedly siphon webcam footage in real time for future lures; Arctic Wolf analyzed more than 950 files, including stolen footage, AI-generated images and composite videos.
- A fake Zoom SDK update prompt triggered payloads for persistence, command-and-control, credential harvesting, crypto wallet theft and Telegram session theft.
- Arctic Wolf says the investigated victim was compromised in under five minutes and the attackers maintained persistence for 66 days.
- The report identified more than 80 typo-squatted Zoom and Teams domains registered with one hosting provider.
- Recommended defenses include verifying meeting requests through a secondary channel, restricting webcam and microphone access, and monitoring for clipboard abuse, PowerShell activity and unauthorized access to browser-stored credentials.
Article Details
- Event Type
- A financially motivated BlueNoroff campaign used fake Zoom meetings, AI-generated avatars, and stolen webcam footage to deliver malware to cryptocurrency executives.
- Impact
- Arctic Wolf reported that payloads enabled persistence, credential and cryptocurrency-wallet theft, and Telegram session theft. It found webcam footage being exfiltrated for use in future lures. In the investigated incident, compromise occurred in under five minutes and BlueNoroff maintained access for 66 days.
MITRE ATT&CK
T1125 · Video CaptureThe attackers captured victims’ webcam footage and reportedly exfiltrated it for use in later fake meetings.T1204.001 · Malicious LinkA victim clicked the malicious meeting link and followed a prompt that led to malware installation.T1566.002 · Spearphishing LinkThe campaign used meeting invitations and a typo-squatted calendar link to lure victims to a malicious meeting page.
People
Threat Actors
Vendors
Products
CalendlyInitial lures include compromised Telegram accounts, Calendly invites, and typoâsquatted calendar links that replace legitimate meeting URLs.Google MeetWhen the victim confirmed the meeting, a Google Meet calendar invite was generated, which the threat actor then covertly modified and replaced with a typo-squatted Zoom URL.TeamsFor example, BlueNoroff had more than 80 typo-squatted Zoom and Teams domains registered with just one hosting provider, with new ones being added on a continuous basis.TelegramInitial lures include compromised Telegram accounts, Calendly invites, and typoâsquatted calendar links that replace legitimate meeting URLs.Zoomhas run a financially motivated campaign targeting cryptocurrency executives by luring them into fake Zoom meetings populated with AI-generated avatars and stolen webcam footage to deliver malware.
Countries
North KoreaNorth Korea’s BlueNoroff has run a financially motivated campaign targeting cryptocurrency executives by luring them into fake Zoom meetings populated with AI-generated avatars and stolen webcam footage to deliverUnited StatesOne incident that Arctic Wolf investigated involved a senior executive at a US-based Web3 cryptocurrency company.