FBI disrupts intricate North Korean fake-call scheme tied to $400M in crypto theft

The FBI disrupted an elaborate North Korean hacking campaign that used secretly recorded videos of victims to impersonate them in online meetings, in a scheme that officials said Thursday has netted more than $400 million in stolen cryptocurrency and threatened widely used software.

The operation, dubbed FaceStealer, tricks people into joining fake video calls with what appear to be familiar contacts, then installing malicious software disguised as a fix for an audio problem. Hackers use the resulting access to steal funds, take over accounts and approach the victim’s friends and colleagues.

Authorities seized cloud infrastructure used in the campaign and more than 900 webcam videos of victims. The FBI also said hackers broke into the computer of a developer who maintains widely used software, then used that access to add malicious code that could reach people downloading it. The attack was detected and stopped before it widely spread.

Separately, the Justice Department announced court authorization to seize or restrain more than $1.2 billion stolen from Binance, the cryptocurrency exchange hit by a roughly $6.3 billion theft last month. Officials said the two campaigns likely involved different North Korean actors.

The FaceStealer operations build on relationships victims already trust. Invitations arrive through genuine accounts that hackers have taken over on services including Telegram, LinkedIn, Slack and Discord, officials say. Access to earlier conversations allows the attackers to make their messages sound familiar, Jeremy Robertson, special agent in charge at the FBI’s Los Angeles Field Office, told reporters. A meeting link directs the target to a website designed to look like Zoom or Microsoft Teams. 

Inside, the target sees a recording of someone they recognize. The attackers sometimes add other apparent participants, making the meeting more convincing. A message then tells the person their audio is not working and supplies instructions to fix it. Those steps — which can include running a script or pasting commands into the computer’s terminal — instead install malware capable of recording keystrokes, capturing screens and giving the hackers continued access.

Meanwhile, the fake meeting records the new victim’s webcam. That footage, combined with stolen accounts and contact lists, helps the hackers repeat the process with someone else.

The campaign highlights a unique degree of scale and creativity on the part of Pyongyang’s cryptocurrency theft operations that have not been publicly outlined before.

“This is not something we can patch,” Robertson said, calling it a “very, very convincing” social engineering scheme.

The targeting has also reached developers who maintain open-source software, which other organizations use to build their own applications. Earlier this year, a maintainer of a JavaScript software library joined a fake Teams meeting featuring someone they recognized and followed instructions that infected their computer, officials said. 

“What we’ve seen over the last six months is a significant evolution in both the scale and sophistication of this operation,” said Justin Moore, director of adversary operations at Arctic Wolf, one of the firms that has assisted the FBI in its efforts to track the operation. “Today, we’ve identified more than 677 targets across 58 countries. We’ve also seen the group’s social engineering playbook expand well beyond fake meetings into document-sharing platforms, identity verification requests, media content, and other trusted business workflows.” 

In the separate Binance case, public and private sector efforts have frozen more than $2.7 billion. The $1.2 billion covered by court orders is part of that total and not an additional recovery.

A senior DOJ official said the government now has custody of the funds covered by those orders. Returning them would generally involve court proceedings to determine ownership, though the official cautioned it was too early to say exactly how that process would unfold.

Binance previously said attackers used a fake job interview to compromise an engineer’s computer before reaching systems used to approve cryptocurrency transfers. The FBI attributed the theft to North Korea’s TraderTraitor group. 

Recovering more of the money is becoming harder as the hackers divide it into smaller amounts and distribute it among laundering networks, the senior DOJ official said.

“These actors have gotten very good at laundering,” the official said. “They’ve learned from their past efforts and our efforts to interdict them.”