The Justice Department has obtained court authorisation to seize more than $1.2 billion stolen from Binance last month. The FBI, in a separate action announced the same day, disrupted a North Korean campaign that used secretly recorded video of victims to deceive their contacts. Here’s a closer look at today’s major cybersecurity headlines.
The Justice Department said on Thursday it had obtained court authorisation to seize or restrain more than $1.2 billion in cryptocurrency taken from Binance on 29 October. The funds are part of more than $2.7 billion that investigators and industry partners have frozen since the breach, which removed roughly $6.34 billion from the exchange. The FBI attributes the theft to TraderTraitor, a hacking unit tied to North Korea’s military. The court order is a legal step towards forfeiture rather than a fresh recovery.
Assistant Attorney General A. Tysen Duva said the department’s divisions acted to freeze the assets “before they got beyond law enforcement reach,” halting “about half of this historic breach.” National Security Division official Scott Proctor said North Korea uses cryptocurrency theft to finance illegal weapons programmes.
Recovering the remainder is proving difficult. The attackers created a new wallet address roughly every 25 seconds to cycle the funds, and have since split the proceeds into smaller amounts across laundering networks. “These actors have gotten very good at laundering,” a senior department official said. “They’ve learned from their past efforts and our efforts to interdict them.”
Sources: The Record, CyberScoop, and Nextgov.
The FBI announced on Thursday that it had seized the cloud infrastructure behind FaceStealer, a social engineering campaign that has taken more than $400 million in cryptocurrency over the past 18 months. Under a federal warrant, the bureau also seized more than 900 webcam recordings of victims. Officials attribute the campaign to a North Korean cluster known as BlueNoroff, Sapphire Sleet or APT38, and say it is a separate operation from the Binance theft.
The scheme spreads from one victim to another, attackers used hijacked accounts on Telegram, LinkedIn, Slack and Discord to invite a previous victim’s contact to a video call, referencing details gained from previous conversations. The link leads to an imposter version of Zoom, Teams or Google Meet. On the call the target sees a recorded footage of someone they know or are associated with, sometimes along with other fake people. A staged fake audio prompts them to click a link, which installs malware that steals cryptocurrency, harvests passwords and contacts, and also records the new victim’s webcam for the next attack.
This year it also lured the maintainers of a widely used JavaScript library into a fake Teams meeting and used that access to insert malicious code. The attempt was detected before it could spread.
“This is not something we can patch,” FBI special agent Jeremy Robertson said.
Sources: GovInfoSecurity, Nextgov, The Record, and AsiaOne.
Both announcements point to the same problem. In Binance the investigators moved quickly and still ended up watching most of the money slip away because laundering now runs faster than it can be traced. FaceStealer relied on a familiar face appearing on a video call. One is difficult to undo once it has happened and the other one is difficult to guard against in the first place.