Key Highlights
- The U.S. Department of Justice says North Korea uses cryptocurrency theft to finance its government and illicit weapons program.
- Federal agents seized cloud infrastructure linked to FaceStealer, a North Korean hacking campaign that the FBI says stole more than $400 million in cryptocurrency in 18 months.
- FaceStealer uses fake Zoom- or Microsoft Teams-style meetings, impersonation, malware and increasingly AI-generated deepfake videos to target victims.
DOJ Targets North Korean Cryptocurrency Theft
The U.S. Department of Justice has announced action against North Korean cybercrime operations accused of stealing cryptocurrency to support the country’s government and illicit weapons program.
“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said M. Scott Proctor, principal deputy assistant attorney general for national security at the DOJ, in a statement. “Today’s announcement shows that America will fight back against that corrupt regime’s effort to profit through cybercrime. The National Security Division will use every tool at its disposal to seize and return North Korea’s ill-gotten gains.”
Advertisement
The DOJ’s action reflects continued efforts by U.S. authorities to disrupt North Korea’s use of cybercrime as a source of revenue. Officials said the National Security Division intends to use available legal and enforcement tools to seize cryptocurrency and seek its return.
FBI Seizes Infrastructure Linked to FaceStealer
In a separate operation, federal agents seized cloud infrastructure used in FaceStealer, a North Korean hacking campaign. The FBI said the operation has stolen more than $400 million in cryptocurrency over the past 18 months.
FaceStealer relies on fraudulent video meetings designed to resemble calls on platforms such as Zoom or Microsoft Teams. The attackers use these meetings to persuade targets to install malicious software or execute commands on their computers.
Hackers impersonate trusted contacts by using secretly recorded webcam footage taken from previous victims. According to the FBI, the campaign is increasingly using AI-generated deepfake videos to make the impersonation more convincing.
How the FaceStealer Scam Works
After a target joins a fake meeting, the attackers claim that a technical issue is preventing the call from working properly. They then instruct the victim to install software or run a command as a supposed fix.
Those instructions instead install malware. The malicious software can steal cryptocurrency and provide attackers with access to other systems connected to the victim’s device or organization.
The FBI said it seized more than 900 webcam videos collected by the attackers. The agency also said FaceStealer operators targeted developers who maintain widely used open-source software, warning that compromising one developer could give hackers a path into broader systems.
Why This Matters
The operation highlights the expanding range of techniques used in North Korean cybercrime, combining cryptocurrency theft with social engineering, malware, stolen video footage and deepfake technology. The targeting of open-source software developers also creates a potential supply-chain risk because access to one developer could expose software or systems used by others.
The DOJ’s stated focus on seizing and returning illicit proceeds indicates that U.S. authorities are pursuing both the technical infrastructure behind these campaigns and the cryptocurrency generated by them. The FBI’s warning underscores the need for users and developers to treat unexpected software installation requests and command-line instructions during video meetings as potential security threats.
Frequently Asked Questions
What is FaceStealer?
FaceStealer is a North Korean hacking campaign that uses fake video meetings, impersonation and malware to steal cryptocurrency and access other systems.
How much cryptocurrency does the FBI say FaceStealer stole?
The FBI said FaceStealer stole more than $400 million in cryptocurrency over the past 18 months.
How do attackers use fake video meetings?
Attackers imitate trusted contacts with recorded webcam footage and increasingly AI-generated deepfake videos. They then claim there is a technical problem and direct victims to install software or run a command that instead deploys malware.
