FBI Pulls Plug On North Korean ‘FaceStealer’ Scheme That Swiped $400 Million In Crypto

The FBI cracked down on a North Korean operation to secretly hack tech employees’ webcams and steal hundreds of millions in cryptocurrency from their colleagues on video calls.

North Korean hackers seized employees’ accounts and covertly recorded webcam footage to pose as victims’ trusted contacts, tricking victims into downloading malware, which resulted in more than $400 million in stolen cryptocurrency across 18 months, according to an FBI report posted Thursday. The scheme, which the FBI dubbed “FaceStealer,” has begun to include the use of AI deepfake technology to rob victims, according to a Thursday FBI Flash alert.

The FBI found that the hackers had recorded more than 900 tech workers, whose footage was used to impersonate them, according to the FBI Flash alert.

Jeremy Robertson, FBI special agent in charge of counterintelligence and cyber at the Los Angeles, CA, field office, explained the North Korean FaceStealer operation in a video posted Friday on the FBI’s YouTube channel.

“North Korean hackers send you a message impersonating someone you know, or someone significant in your industry … Next, they lure you into a realistic but imposter Zoom or Teams meeting,” Robertson said in the video.

The hackers record the victim without their knowledge as their wait for the meeting to begin, which the hackers will later use to impersonate them, Robertson explained. The other meeting participant or participants are recordings of other victims.

The hackers then instruct the victim to download malware that enables them to access the victim’s computer, by telling the individual their meeting audio is not working and sending them an “update” to fix it, Robertson said.

The Department of Justice said Thursday it took control of the hackers’ online setup and seized the stolen webcam videos, according to the department’s press release.

“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” Principal Deputy Assistant Attorney General for National Security M. Scott Proctor said according to the press release. “The National Security Division will use every tool at its disposal to seize and return North Korea’s ill-gotten gains.”