The US government on Thursday said it had obtained court authorization to seize or restrain use of over $1. 2 billion stolen during last month’s $6. 3 billion Binance heist, as part of a larger effort to disrupt North Korea’s ongoing cryptocurrency theft. The court also allowed the takedown of cloud-based infrastructure used in a Democratic People’s Republic of Korea (DPRK) social engineering scheme called “FaceStealer” that has amassed more than $400 million in the last 18 months. It’s called FaceStealer because it involved secretly recorded webcam videos. Victims are typically people working in the cryptocurrency and web3 industries, along with open source software developers and maintainers who DPRK hackers target in the hope of accessing the software repositories they control as the first step towards creating supply chain attacks. 900+ faces stolen
The FBI said it had seized more than 900 webcam videos belonging to these tech workers. Here’s how the attack works. First, the North Koreans send targets an invitation to join a video meeting. Those invitations come from hijacked accounts that the next intended victim may find familiar or credible. “You’re going to think it’s real because it’s going to be based on either conversations or interests you’ve expressed in the past with this actual person,” said special agent Jeremy Robertson, who oversees counterintelligence and cyber investigations at FBI Los Angeles. “They’re going to then send you a link to catch up, and it’s usually a calendar invite, and it’s going to have some typo-squatted URLs in there,” he told reporters on Thursday. The URL directs the victim to a fake Zoom or Teams meeting, and the cybercriminals record the target’s webcam video while playing a phony, prerecorded video of the person who purportedly sent the meeting invite. Sometimes the hackers also use deepfake videos of well-known individuals in the cryptocurrency and web3 industries, we’re told. “When you log in, whoever invited you – your friend or business associate – is going to be on the screen, but you’re not going to hear any audio,” Robertson said…