North Korean Hackers Stole $400 Million With Stolen Faces
North Korean state backed hackers have stolen more than 400 million US dollars in cryptocurrency over the past 18 months by recording people on video calls and using their faces to trick their contacts, according to the FBI.
The bureau calls the technique FaceStealer, and it works because the invitation looks like it comes from someone the target already knows.
And the mechanics are cheap. Victims receive a video call invitation from a genuine contact whose social media and messaging accounts have already been compromised and whose image has been secretly recorded, on an impostor version of Zoom, Microsoft Teams or Google Meet, and they join because the name is familiar.
Once the call connects the target is recorded too. A mock technical error appears, the fix requires clicking a link, and the link infects the computer and the victim's social accounts, which are then used to invite the next round of targets from a face that their contacts recognise.
The bureau said an advisory issued this week described more than 900 victim webcam videos it had identified and seized, which gives a sense of how much material the campaign has accumulated and how little each recording needs to be worth to be useful.
But the part that should worry anyone in the industry is what comes next. The FBI said the hackers are starting to use artificial intelligence to generate deepfake videos of well known and influential people in cryptocurrency and blockchain, which turns a library of ordinary faces into a tool for impersonating the people whose endorsements move money.
The activity is attributed to a cluster of North Korean hackers tracked as Sapphire Sleet or UNC1069. The FBI and private researchers have linked a separate North Korean group to the recent 6.3 billion dollar hack of the cryptocurrency exchange Binance, so this is one operation inside a wider programme rather than a single crew.
The economics explain the persistence. A video call costs nothing, a compromised account costs nothing to reuse, and a successful infection can reach an entire contact list, so the campaign scales without new tools for each victim.
So the defence is not better antivirus but a habit, since a familiar face on a call proves nothing when the image can be recorded from the last call and the account can be taken from the last click, and the practical rule is to verify any unexpected meeting request through a second channel before joining.
The FBI says North Korean hackers stole more than 400 million dollars in 18 months
FaceStealer lures targets to fake video calls using compromised contacts and recorded faces
A fake technical error and a link infect the target's computer and accounts
The FBI identified and seized more than 900 victim webcam videos
The group is tracked as Sapphire Sleet or UNC1069 and is separate from the Binance hackers
Source: Reuters
