The Federal Bureau of Investigation (FBI) said on Thursday that state-backed North Korean hackers had stolen more than $400 million worth of cryptocurrency over the past 18 months by secretly recording people and using the footage to target their personal contacts.
Victims are lured into video calls through fake versions of video-conferencing applications such as Zoom, Microsoft Teams and Google Meet, as part of a scheme the FBI calls “FaceStealer.”
Targets receive invitations from genuine contacts with whom they have previously interacted. However, those contacts’ social media and other communication accounts have been compromised, allowing hackers to secretly record their images.
Once victims join the call, which is also recorded, they encounter a fake technical error requiring them to click on a link to fix the problem. This infects their computers and compromises their social media accounts. The attackers then use the victims’ contacts to target additional individuals.
In an alert issued on Wednesday, the FBI said it had identified and seized more than 900 video recordings captured through victims’ webcams.
The FBI added that hackers had begun using artificial intelligence to create fake videos through deepfake technology, impersonating well-known and influential figures in the cryptocurrency and blockchain industries.
The FBI attributed these activities to a group of North Korean hackers known as “Sapphire Sleet,” also identified as UNC1069. The group is separate from the North Korean hackers whom the FBI linked to a recent breach of the Binance cryptocurrency exchange, during which $6.3 billion was stolen.
