The U.S. government said Thursday that it undermined North Korea’s cryptocurrency-theft operations by seizing infrastructure associated with a complex social-engineering campaign and recovering some of the funds that Pyongyang stole from Binance.
Federal agents obtained a court’s permission to seize more than 900 webcam videos that North Korea used to trick targets into participating in video calls that led to the delivery of cryptocurrency-stealing malware, the Justice Department said in a statement. The government also used a court order to seize more than $1.2 billion in cryptocurrency stolen in the record-breaking Binance hack.
“Today’s announcement shows that America will fight back against that corrupt regime’s effort to profit through cybercrime,” M. Scott Proctor, the principal deputy assistant attorney general for national security, said in a statement.
The twin law-enforcement actions targeting North Korea reflect the U.S. government’s intense focus on preventing Kim Jong-un’s regime from using cyberattacks to evade sanctions and finance weapons programs.
Crackdown on FaceStealer deception
The seized webcam videos were a critical component of North Korea’s “FaceStealer” operation, U.S. officials said. North Korean operatives used them to lure victims into participating in video calls, during which the operatives would claim that a technical error was interfering with the conversation and persuade the target to install software to fix the issue. In reality, the software delivered malicious code that North Korea deployed to steal digital currency and otherwise commandeer the victims’ machines.
“In several reported cases, the hackers stole cryptocurrency and hijacked communication accounts several months to more than a year after the initial compromise,” DOJ said. “As part of the scheme the hackers also accessed the new victim’s contact lists, social media, and communications apps to target the victim’s personal and professional contacts.”
Most of the victims worked at technology companies, especially cryptocurrency firms, the government said, but North Korea has recently begun targeting the maintainers of critical open-source software packages in an attempt to compromise those packages.
Most of the videos used to trick victims were of previous victims, but some were AI-generated deepfakes of “well-known and influential individuals,” according to the DOJ.
The FBI published an alert about FaceStealer that laid out the multistage scheme and offered recommendations for avoiding it.
The alert described North Korea’s sustained efforts to compromise “a significant open-source JavaScript library” that “receives tens of millions of downloads per week.” Through a video call with the project’s maintainer that appeared to include one of the victim’s trusted contacts, North Korea convinced the target to install malware that let operatives “create malicious dependencies that would be downloaded along with legitimate library downloads,” the alert said.
“The FBI is aware of several other attempts by North Korean hackers to target software developers, maintainers, and software libraries with significant download volume,” the bureau warned.
Binance funds recovered
The late-October cyberattack on Binance is considered the most financially devastating incident in the short history of the cryptocurrency industry. Hackers — whom the FBI and private cybersecurity firms have linked to North Korea — stole roughly $6.3 billion in digital currency from the company. Since the attack, government agencies and blockchain analysts have worked together to freeze almost half of the stolen funds. The FBI’s recovery of more than $1.2 billion is the latest contribution to that effort.
“Efforts to trace, freeze, seize, and forfeit the stolen virtual assets are ongoing,” the government said, noting that Pyongyang’s operatives “continue to launder such assets through various cryptocurrency bridges, mixers, and exchanges.
