The Federal Bureau of Investigation (FBI) is releasing this FLASH to alert the cryptocurrency/web3 industry and open-source software maintainers of a highly effective North Korean social engineering scheme that the FBI calls “FaceStealer.” The FBI attributes this activity to North Korean state-sponsored hackers, known publicly by the names Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima. Using the FaceStealer scheme, the actors have stolen more than $400 million in cryptocurrency over the past 18 months and attempted to compromise the open-source software supply chain.
FaceStealer relies on imposter versions of popular video meetings like Zoom, Microsoft Teams and Google Meets controlled by the hackers. Targets are lured to the fake video meetings through invitations from genuine communication and social media accounts that were hijacked from prior victims. The actors have hijacked accounts on platforms including Telegram, LinkedIn, Slack, and Discord. Once a target joins a fake meeting, hackers play prerecorded webcam videos of previous victims to simulate a legitimate video call with participants the target knows. The hackers also record the victim’s webcam video.
The hackers then introduce a mock technical error into the meeting and, while impersonating the victim’s trusted contact, provide instructions to fix the problem. The “fix” installs malware on the target’s computer, turning the target into the next victim. With the victim’s computer compromised, the North Korean hackers can steal accessible cryptocurrency or exploit the victim’s access to external infrastructure, such as an employer’s network or an open-source software maintainer’s
account.
Recommendations• When joining a video chat, use the official video chat application (i.e. Zoom or Teams) and use an invite code instead of clicking on links to join web versions of the applications. This best practice should be followed particularly when responding to invitations from infrequent or new contacts. This will help to protect against being lured into an imposter video chat session.
• When joining a video chat that you have been invited to attend, do not turn on your webcam until you are able to see, hear, and communicate with the person who invited you. This best practice should be followed particularly when responding to invitations from infrequent or new contacts. By delaying the start of your web camera, you give yourself the opportunity to visually inspect and communicate with the person who invited you before offering up your webcam feed.
• If prompted for an update while using a video chat service, do not run scripts or copy code into the command line or terminal to update the client. Instead, separately update the communication application or join the meeting through web versions of the service with the invite code.
• Inspect Calendly or other calendaring invites for meeting links. North Korean hackers frequently do not include video chat links in their scheduling emails, instead sending malicious video chat links closer to the appointed meeting date and time. They do this to minimize exposure of their malicious infrastructure.
• When possible, confirm a scheduled video chat meeting with the person who invited you through an alternate communication method from how you were contacted. For example, if you receive a Telegram message, confirm the meeting by text or phone if you have that information.
• Secure Telegram, WhatsApp, Slack, and other apps used for communication by adding multifactor authentication, turning on login alerts, and using expiring messages. This will help to protect your communication applications from being hijacked and limit accessible chat histories if they are hijacked. The hackers will hijack the accounts by logging onto the account from a different device, changing the recovery account such as the recovery phone number, then closing your sessions.
• Enhance the security of your cryptocurrency by keeping only low-dollar amounts on browser extension wallets. Keep larger cryptocurrency balances on a separate physical ledger (not connected to the device) or deposited with an exchange. Do not keep any secret recovery phrases or private keys anywhere on your devices. North Korean hackers have been known to copy recovery phrases, patiently monitor balances on the blockchain, and reconstitute the wallet (stealing your cryptocurrency) following a large transfer.
Read the full details here
