The Justice Department on Thursday announced coordinated actions against North Korean groups’ campaigns that have stolen billions of dollars in cryptocurrency, seizing cloud infrastructure behind a social engineering scheme known as FaceStealer and the court-authorized seizure of more than $1.2 billion stolen from cryptocurrency exchange Binance.
The larger of the two operations is tied to the theft of more than $6 billion in virtual assets from Binance, which the FBI has attributed to North Korean military hackers it calls TraderTraitor. Investigators working with private virtual asset service providers have frozen more than $2.7 billion of the stolen funds, and courts have authorized the seizure of more than $1.2 billion of that amount.
A. Tysen Duva, the assistant attorney general in charge of the DOJ’s Criminal Division, said its computer crime section and partners froze the stolen Binance assets “before they got beyond law enforcement reach,” halting “about half of this historic breach.”
The FBI also issued an alert Thursday that detailed the scheme’s mechanics. Hackers known publicly as Sapphire Sleet, BlueNoroff, APT38 and Stardust Chollima hijack accounts on Telegram, LinkedIn, Slack and Discord and invite targets to video meetings. Links lead to typo-squatted domains, hosting imposter versions of Zoom and Microsoft Teams “designed by the hackers to be indistinguishable from the genuine interfaces.”
The infrastructure seized by the FBI contained a library of more than 900 secretly recorded webcam videos that the hackers played to impersonate victims in follow-on attacks. The footage was captured from victims as they waited for video chats to begin. The alert published redacted and blurred examples of the library. Because each compromise yields the next victim’s video and contact lists, the pool of targets and victims “grows exponentially,” the alert warned.
The campaign has drained more than $400 million from the cryptocurrency and Web3 sectors over the past 18 months. The FBI said it has seized more than 900 victim videos used to impersonate victims in follow-on attacks.
Patrick Grandy, the assistant director in charge of the FBI’s Los Angeles field office, said the scheme is “capable of deceiving even the most experienced technical and security conscious computer user.”
“It exploits our trust in ubiquitous video conference platforms and valued personal relationships,” he said.
The alert also showed the scheme’s reach beyond its direct victims, showing how it was used earlier this year to lure the maintainer of a significant open-source JavaScript library into a fake Teams meeting. Hackers then used the maintainer’s access to create malicious dependencies that could have been downloaded alongside legitimate ones.
For years, North Korea has committed cryptocurrency heists alongside the regime’s expansive scheme to get remote IT workers hired at U.S. businesses, ultimately to launder ill-gotten money and evade economic sanctions.
Justin Moore, director of adversary operations at Arctic Wolf, told CyberScoop that even with the law enforcement actions, there has been a “significant evolution in both the scale and sophistication” of North Korean schemes.
“While the tactics continue to evolve, the goal remains the same,” Moore told CyberScoop. “They’re exploiting trust to lower a target’s guard and convince them to take an action that leads to compromise. That’s what makes operations like this so effective and why efforts to disrupt them are so important.”
“Cryptocurrency unfortunately has become fertile ground for North Korea to defraud victims and fund its malign activities,” said Bill Essayli, a U.S. attorney for the Central District of California. “Today’s seizure shows that America will continue the fight against rogue states who financially gain from cybercrime.”
The FBI credited the cybersecurity firms Arctic Wolf, Jumpsec and Microsoft Threat Intelligence Center for assisting in the investigation and seizure.
The post US seizes North Korean hacking infrastructure, $1.2 billion in cryptocurrency stolen from Binance appeared first on CyberScoop.
from CyberScoop https://ift.tt/gz3RGKQ
https://ift.tt/ugl3Xzd
