Crypto Executives Targeted in $400M North Korea Hacking Scheme: FBI
The FBI has disrupted infrastructure used by North Korean hackers in a social engineering scheme that targeted crypto and Web3 workers.
According to the bureau, the attackers used fake Zoom and Microsoft Teams meetings to record the webcams of victims, install malware, and impersonate experienced industry pros.
How North Korean Hackers Used Fake Meetings
In a video posted on X, Jeremy Robertson, the special agent in charge of counterintelligence and cyber at the FBI’s Los Angeles field office, explained how the North Koreans had been running the scheme he called FaceDealer.
According to him, the attackers usually sent potential victims a message impersonating someone they either knew or could recognize as being important in the industry. What often made the contact look legitimate is that the hackers hijacked the person’s social accounts, including their Telegram or LinkedIn.
After that, they lured the victim into a fake but realistic-looking Zoom or Teams meeting that they had built and had complete control of.
“While you wait for the meeting to start, they secretly record your webcam so they can later impersonate you,” said Robertson.
When the meeting finally started, the victim would see the webcam video of the person who supposedly invited them, but who of course wasn’t there, with the video being that of an earlier victim. And just to add a little pressure and push the target into the scheme’s next step, Robertson said the scammers often added a few extra fake participants and then messaged the victim that the other party was having trouble hearing them.
“The hackers generate a fake error message indicating you need to perform an update. Everyone in the meeting is waiting for you to fix this problem.”
Fixing the problem involved running a fake update the hackers sent to the victim, and if they ran it, they unwittingly downloaded malware that gave the attackers access to their computer, crypto wallets, and even social media accounts.
900 Victims and Over $400 Million Stolen
In the video, the special agent said that the FBI had found and disrupted videos from more than 900 victims, all of them experienced professionals in crypto, Web3, as well as cybersecurity.
“Think you wouldn’t fall for it? Don’t be sure. This is a highly effective social engineering scheme,” Robertson cautioned.
Additionally, he said that FaceDealer had resulted in over $400 million in thefts in just 18 months.
This isn’t the first time the agency is blaming North Korean actors for theft in the crypto space. Just last month, Binance was hit for $6.3 billion, with the FBI stating that a DPRK cyber campaign known as “TraderTraitor” was behind the breach. It also confirmed that the attackers were converting the stolen loot into ETH and running it through DeFi platforms and instant swap services.
However, officials in Pyongyang have come out strongly to deny the accusation, calling it “absurd rhetoric” and insinuating that the United States stood to gain the most from the theft, since it could confiscate the stolen funds if it were recovered and put it into its national strategic reserve.