FBI Disrupts North Korean FaceStealer Deepfake Crypto-Theft Scheme
Summary
The FBI says it disrupted cloud infrastructure used in the FaceStealer campaign, attributed to North Korean group BlueNoroff. The scheme uses deepfake video calls and malware to steal crypto-related access and spread through victims’ contacts.
Key points
- The FBI attributed the FaceStealer campaign to BlueNoroff, also known as Sapphire Sleet or Stardust Chollima.
- Attackers reportedly use typosquatted meeting links and AI-generated deepfakes to lure victims into calls, then direct them to download malware.
- The malware reportedly searches for cryptocurrency wallets and seed phrases, accesses social accounts and contacts, and records webcam video.
- The FBI said it seized more than 900 victim webcam videos from the group’s cloud storage.
- The FBI’s FaceStealer loss estimate covers only victims it could identify; the article does not establish a complete total for the campaign.
- The FBI said FaceStealer’s use in the separate Binance hack is unknown. The article also reports that the Binance attackers used a poisoned Homebrew package for initial access.
Article Details
- Event Type
- U.S. law enforcement disruption of cloud infrastructure used in the FaceStealer deepfake-enabled cryptocurrency fraud campaign.
- Impact
- The FBI said it seized more than 900 victim webcam videos from the threat actor's cloud storage. The downloaded malware scans for cryptocurrency wallets and seed phrases, accesses social media accounts and contacts, and secretly records webcam video to help lure subsequent victims. The article reports at least $400 million in cryptocurrency stolen by the group over the past 18 months, while noting that the FaceStealer loss estimate is limited to victims the FBI could identify.
MITRE ATT&CK
T1125 · Video CaptureThe malware secretly recorded victims' webcam video.T1204.001 · Malicious LinkVictims were instructed to click a link that downloaded malware.T1566.002 · Spearphishing LinkAttackers sent victims typosquatted calendar-invite links that led to an attacker-controlled video-conference platform.
People
Threat Actors
BlueNoroffThe article attributes the FaceStealer campaign and recent open-source software supply-chain attacks to this financially motivated North Korean group.Jade SleetThe article identifies TraderTraitor as the separate group behind the Binance attack, which it says involved poisoning a version of Homebrew.Sapphire SleetThe article gives Sapphire Sleet as another name for the group it identifies as responsible for the FaceStealer campaign and recent supply-chain attacks; that group is reported to target cryptocurrency and Web3 organizations.STARDUST CHOLLIMAThe article gives Stardust Chollima as another name for the group it identifies as responsible for the FaceStealer campaign and recent supply-chain attacks; that group is reported to target cryptocurrency and Web3 organizations.
Malware
Products
Homebrewalso relied on a third-party supply chain compromise to gain initial access. They poisoned a version of Homebrew, a third-party package manager for macOS, and a Binance wallet infrastructure engineer downloaded theMastrachain attacks in recent months, poisoning packages associated with artificial intelligence framework Mastra and JavaScript and Python libraries. The group exploits access gained from a single compromisedTeamscompromised victim's contact, asking to catch up or discuss more about a past conversation on Zoom or Teams, said FBI agent Jeremy Robertson. But the calendar invite link they provide is typosquatted and goes to anZooma previously compromised victim's contact, asking to catch up or discuss more about a past conversation on Zoom or Teams, said FBI agent Jeremy Robertson. But the calendar invite link they provide is typosquatted and
Countries
North KoreaU.S. law enforcement disrupted cloud infrastructure used by financially motivated North Korean hackers in a worm-like deepfake fraud scheme that propagated from one victim to the next.United StatesU.S. law enforcement disrupted cloud infrastructure used by financially motivated North Korean hackers in a worm-like deepfake fraud scheme that propagated from one victim to the next.