The FBI said it has disrupted a highly tailored, hard-to-detect cryptocurrency theft scheme by a North Korean hacking group that has managed to steal billions across the world in recent years. The hackers have aggressively targeted people in the cryptocurrency and Web3 industries, as well as workers in the development and maintenance of open-source software, the FBI said in a written statement. Web3, in general, describes internet applications that interact with a blockchain — a digital ledger that stores data. On Thursday, the FBI and Department of Justice announced the disruption of a cloud-based infrastructure used by the North Korean hackers, resulting in the seizure of more than 900 webcam videos of victims working in the crypto and Web3 industries worldwide. Before the operation was disrupted, the scheme resulted in the theft of more than $400 million over an 18-month period. FBI officials say the funds are used to bankroll its “rogue regime and illicit weapons program through cryptocurrency theft” and the videos are employed to impersonate and target more victims.“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said Principal Deputy Assistant Atty. Gen. for National Security M. Scott Proctor.“The FBI attributes this activity to the North Korean hacking group commonly referred to in the private sector as Sapphire Sleet, UNC1069, Stardust Chollima, APT38, and BlueNoroff,” the FBI said in a written statement.“Cryptocurrency unfortunately has become fertile ground for North Korea to defraud victims and fund its malign activities,” Bill Essayli, the top federal prosecutor for Los Angeles, said in a written statement. “Today’s seizure shows that America will continue the fight against rogue states who financially gain from cybercrime.”The federal agency said the hackers used several tactics to compromise victims, including a sophisticated social engineering scheme dubbed “FaceStealer.” The scheme involves hijacking LinkedIn, Telegram, Slack and Discord accounts of people known to the victim, then impersonating those people to make contact and lure the victims into video calls using Zoom, Microsoft Teams and Google Meets. As the victim waits for the call to start, the hackers secretly record them to impersonate them later. Once the call starts, the impersonator attempts to persuade the victim to download malware, often under the guise of resolving a technical issue.“Their objective is compromise of the software supply chain. By infiltrating accounts of trusted developers and maintainers, the threat actors can potentially distribute malicious code through widely used software, impacting millions of downstream users,” the FBI said in its written statement. FBI Cyber Branch Operations Director Brett Leatherman said in a statement that the “North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years.” Separately from the FaceStealer scheme, members of the North Korean military, referred by the FBI as “TraderTraitor,” stole more than $6 billion in cryptocurrency from the world’s largest crypto exchange Binance on Oct. 29, according to federal authorities. Binance said it has replaced the stolen assets to its customers, but not recovered the stolen loot. Federal authorities said they have worked closely with private companies to recover the stolen funds, freezing more than $2.7 million and obtaining court approval to seize or restrict access to $1.2 billion of that amount. FBI officials said efforts to trace, freeze, seize and forfeit the stolen virtual assets are ongoing. Additionally, the agency put out a flash alert on its website to inform the public of the FaceStealer campaign. Sign up for Essential California for news, features and recommendations from the L.A. Times and beyond in your inbox six days a week. This story originally appeared in Los Angeles Times.
Click Here For The Original Source.
——————————————————–
