North Korean hackers have been aggressively targeting cryptocurrency and Web3 industries with a sophisticated social engineering scheme known as FaceStealer. The FBI attributes this activity to the hacking group Sapphire Sleet, also referred to as UNC1069, Stardust Chollima, APT38, and BlueNoroff. The scheme involves imposter video conferencing platforms, secretly recorded webcam footage, and computer intrusions to steal billions in cryptocurrency.
The hackers have increasingly focused on open-source software developers and maintainers, aiming to compromise the software supply chain. By infiltrating trusted accounts, they can distribute malicious code to millions of downstream users. The FBI and DOJ recently disrupted cloud-based infrastructure used in this scheme, seizing over 900 webcam videos of victims in the crypto and Web3 sectors worldwide.
Over the last 18 months, the FaceStealer scheme has resulted in the theft of more than $400 million. The exploit lifecycle involves compromising and recording a victim’s webcam, hijacking communication accounts, delivering fake video links, and impersonating the victim to trick new targets into self-infection. The FBI has provided additional information and best practices to protect against future targeting in their FLASH report.