North Korean hackers steal more than $400 million using video images, FBI says

Nov 12 (Reuters) – North Korean state-backed hackers have stolen more than $400 million in cryptocurrency over the past 18 months using surreptitiously ​recorded images of people which are then ‌used to target their contacts, the FBI said Thursday.

The Details

• As part of a social engineering scheme, which the FBI refers to as “FaceStealer,” targets are lured to video chats ‌on ​imposter versions of video meeting ⁠software such as Zoom, ⁠Microsoft Teams and Google Meet.

• The targets are issued invitations from genuine contacts they have previously interacted with, but whose social media and communication ​accounts have been compromised and whose images have been secretly recorded.

• Once on the call, ⁠the targets — who are also ⁠being recorded — encounter a mock technical ​error which requires a fix by clicking a link, ​which then infects the target’s computer and social ‌media accounts. The target’s contacts are then used to target additional people.

• The FBI has identified and seized more than 900 victim webcam videos, ⁠according to Wednesday’s advisory.

• Hackers are starting to use artificial intelligence to create deepfake videos of well-known and influential ⁠people in ‌the cryptocurrency and blockchain industries, the ⁠FBI said.

• The FBI attributed the ​activity to ‌a cluster of North Korean hackers ​known as “Sapphire ⁠Sleet” or UNC1069, a separate group from the North Korean hackers linked by the FBI and private industry to the recent $6.3 billion hack of cryptocurrency exchange Binance.

(Reporting by AJ Vicens in Detroit; Editing by ​Nia Williams)