U.S. Seizes Infrastructure Tied to North Korean Schemes and $1.2 Billion Linked to Binance Theft
Summary
The DOJ said it seized cloud infrastructure tied to the FaceStealer social-engineering scheme and obtained court authorization to seize over $1.2 billion in funds stolen from Binance; the FBI attributed the theft to North Korea-linked TraderTraitor.
Key points
- The DOJ announced actions targeting North Korean cryptocurrency theft campaigns, including seizure of cloud infrastructure behind FaceStealer and court-authorized seizure of over $1.2 billion linked to the Binance theft.
- The FBI attributed the theft of more than $6 billion from Binance to North Korean military hackers it calls TraderTraitor. Investigators and private firms froze over $2.7 billion; courts authorized seizure of over $1.2 billion.
- An FBI alert said operators hijack Telegram, LinkedIn, Slack, and Discord accounts to invite targets to fake video meetings hosted on typo-squatted domains impersonating Zoom and Microsoft Teams.
- The seized infrastructure contained a library of more than 900 secretly recorded webcam videos, which the FBI said were used to impersonate victims in follow-on attacks.
- The FBI said the campaign drained over $400 million from cryptocurrency and Web3 sectors in the past 18 months.
- The FBI alert described a fake Teams meeting used to lure an open-source JavaScript library maintainer; attackers then used the maintainer’s access to create malicious dependencies that could be downloaded alongside legitimate ones.
Article Details
- Event Type
- U.S. law enforcement disruption of North Korean cybercrime campaigns, including seizure of cloud infrastructure used in a social engineering scheme and court-authorized seizure of cryptocurrency stolen from Binance.
- Impact
- More than $6 billion in virtual assets was stolen from Binance. Investigators froze more than $2.7 billion, and courts authorized seizure of more than $1.2 billion. The FBI also seized infrastructure containing more than 900 secretly recorded victim videos used to impersonate victims in follow-on attacks. The scheme has drained more than $400 million from the cryptocurrency and Web3 sectors over 18 months, and access gained through a fake meeting was used to create malicious dependencies that could have been downloaded alongside legitimate ones.
MITRE ATT&CK
People
Andrew Tysen DuvaAssistant attorney general in charge of the DOJ's Criminal Division; described the actions taken to freeze stolen Binance assets.Bill EssayliU.S. attorney for the Central District of California; commented on the cryptocurrency seizure and North Korean cybercrime.Justin MooreDirector of adversary operations at Arctic Wolf; commented on the evolution and tactics of North Korean schemes.Patrick GrandyAssistant director in charge of the FBI's Los Angeles field office; characterized the deceptive capabilities of the FaceStealer scheme.
Threat Actors
APT38Named in the FBI alert as a public name for hackers involved in the scheme that hijacked accounts and used fake video-meeting invitations.BlueNoroffNamed in the FBI alert as a public name for hackers involved in the scheme that hijacked accounts and used fake video-meeting invitations.Jade SleetThe FBI attributed the theft of more than $6 billion in virtual assets from Binance to North Korean military hackers it calls TraderTraitor.Sapphire SleetNamed in the FBI alert as a public name for hackers involved in the scheme that hijacked accounts and used fake video-meeting invitations.STARDUST CHOLLIMANamed in the FBI alert as a public name for hackers involved in the scheme that hijacked accounts and used fake video-meeting invitations.
Vendors
Arctic WolfJustin Moore, director of adversary operations at Arctic Wolf, told CyberScoop that even with the law enforcement actions, there has been a “significant evolution in both the scale and sophistication” of North KoreanJumpsecThe FBI credited the cybersecurity firms Arctic Wolf, Jumpsec and Microsoft Threat Intelligence Center for assisting in the investigation and seizure.MicrosoftLinks lead to typo-squatted domains, hosting imposter versions of Zoom and Microsoft Teams “designed by the hackers to be indistinguishable from the genuine interfaces.”ZoomLinks lead to typo-squatted domains, hosting imposter versions of Zoom and Microsoft Teams “designed by the hackers to be indistinguishable from the genuine interfaces.”
Products
Binanceand the court-authorized seizure of more than $1.2 billion stolen from cryptocurrency exchange Binance.DiscordHackers known publicly as Sapphire Sleet, BlueNoroff, APT38 and Stardust Chollima hijack accounts on Telegram, LinkedIn, Slack and Discord and invite targets to video meetings.LinkedInHackers known publicly as Sapphire Sleet, BlueNoroff, APT38 and Stardust Chollima hijack accounts on Telegram, LinkedIn, Slack and Discord and invite targets to video meetings.Microsoft TeamsLinks lead to typo-squatted domains, hosting imposter versions of Zoom and Microsoft Teams “designed by the hackers to be indistinguishable from the genuine interfaces.”SlackHackers known publicly as Sapphire Sleet, BlueNoroff, APT38 and Stardust Chollima hijack accounts on Telegram, LinkedIn, Slack and Discord and invite targets to video meetings.TelegramHackers known publicly as Sapphire Sleet, BlueNoroff, APT38 and Stardust Chollima hijack accounts on Telegram, LinkedIn, Slack and Discord and invite targets to video meetings.ZoomLinks lead to typo-squatted domains, hosting imposter versions of Zoom and Microsoft Teams “designed by the hackers to be indistinguishable from the genuine interfaces.”
Countries
Industries
Cryptocurrencycoordinated actions against North Korean groups’ campaigns that have stolen billions of dollars in cryptocurrency, seizing cloud infrastructure behind a social engineering scheme known as FaceStealer and theWeb3The campaign has drained more than $400 million from the cryptocurrency and Web3 sectors over the past 18 months.