US authorities seized cloud infrastructure used in a North Korea-linked video-call scam that allegedly stole more than $400 million in cryptocurrency over 18 months, the Justice Department said on November 12. The FBI calls the operation “FaceStealer.”
According to the Justice Department, the attackers sent meeting invitations from accounts previously taken over from other victims. During calls, they used recorded webcam footage to make it appear that a target’s trusted contact was present, then staged a technical problem and directed the target to a link that installed malware.
Authorities said some victims were not robbed until months after the malware was installed, with delays of more than a year in some cases. The hackers then used victims’ contacts to find additional targets. The FBI also said the attackers had begun using AI-generated deepfakes of well-known cryptocurrency figures.
Authorities separate scam from Binance theft
The campaign targeted people in cryptocurrency and other internet-related industries, with open-source software developers increasingly in its sights, the Justice Department said. The FBI seized more than 900 webcam videos linked to victims under a federal warrant.
FaceStealer is separate from the Binance hack, which US authorities attribute to another North Korea-linked group, TraderTraitor. The FBI said that theft took place around October 29 and involved more than $6 billion in cryptocurrency. US agencies and private companies have frozen more than $2.7 billion in assets, while the department said a court had authorized the seizure or restraint of more than $1.2 billion.
The Justice Department said the two operations involve different hacking groups. North Korea has denied involvement in the Binance hack.
Nicole French 
Reid Bentley