Explore

Rapid ReadRapid Read
FBI Disrupts North Korean 'FaceStealer' Cryptocurrency Theft Scheme Targeting Web3 Industries

FBI Disrupts North Korean 'FaceStealer' Cryptocurrency Theft Scheme Targeting Web3 Industries

The FBI and the Department of Justice have successfully disrupted cloud-based infrastructure used by North Korean hacking groups in a sophisticated cryptocurrency theft scheme known as 'FaceStealer.' These cyber actors, identified by various names including Sapphire Sleet, UNC1069, Stardust Chollima, and APT38, have aggressively targeted companies and individuals in the cryptocurrency and Web3 industries. The scheme involves highly tailored social engineering campaigns, utilizing imposter versions of popular video conferencing platforms and secretly recorded webcam videos. The FBI identified and seized over 900 webcam videos of victims globally, primarily those working in the crypto and Web3 sectors. This operation follows the theft of more than $400 million in cryptocurrency over the past 18 months attributed to this group. The hackers aim to compromise software supply chains by infiltrating accounts of trusted developers and maintainers, potentially distributing malicious code to millions of users.
Rapid ReadRapid Read
Justice Department Disrupts North Korean Cryptocurrency Theft Operations, Seizes Over $1.2 Billion

Justice Department Disrupts North Korean Cryptocurrency Theft Operations, Seizes Over $1.2 Billion

The Department of Justice has announced coordinated actions to disrupt North Korea's government-backed schemes to fund its regime through massive cryptocurrency theft. These actions include the seizure of cloud-based infrastructure used in the 'FaceStealer' social engineering scheme, which has resulted in the theft of over $400 million in cryptocurrency. Additionally, the Justice Department has obtained court authorization to seize and restrain more than $1.2 billion worth of cryptocurrency recently stolen from Binance, a virtual currency exchange. North Korean hackers, known by various names including Sapphire Sleet and APT38, employ sophisticated tactics such as luring targets into video meetings using stolen accounts, recording webcams, and playing prerecorded videos of trusted contacts to gain trust. They also utilize 'super intelligence' (SI) to create deepfake videos of influential individuals in the cryptocurrency and web3 industries to enhance the effectiveness of their schemes. These hackers then ...
Rapid ReadRapid Read
FBI Disrupts 'FaceStealer' Cryptocurrency Theft Scheme Linked to North Korean Hackers

FBI Disrupts 'FaceStealer' Cryptocurrency Theft Scheme Linked to North Korean Hackers

The FBI has successfully disrupted infrastructure used by North Korean hackers in a global cryptocurrency theft scheme known as 'FaceStealer.' According to Jeremy Robertson, special agent in charge of Cyber and Counterintelligence at FBI Los Angeles, this sophisticated social engineering operation has resulted in over $400 million in thefts and the impersonation of more than 900 victims within the crypto and Web3 industries over the past 18 months. The scheme involves hackers impersonating individuals known to the targets, often by hijacking Telegram or LinkedIn accounts to establish legitimacy. Victims are then lured into fake Zoom or Microsoft Teams meetings, where their webcams are secretly recorded. During these meetings, the impersonator claims audio issues and prompts the victim to download a fake update, which is actually malware. This malware grants the hackers access to the victim's computer, cryptocurrency, and social media accounts, perpetuating the cycle of impersonation and theft.
Rapid ReadRapid Read
FBI Disrupts North Korean 'FaceStealer' Hacking Campaign Tied to $400 Million Crypto Theft

FBI Disrupts North Korean 'FaceStealer' Hacking Campaign Tied to $400 Million Crypto Theft

The FBI has successfully disrupted an elaborate North Korean hacking operation, dubbed 'FaceStealer,' which has been linked to over $400 million in stolen cryptocurrency and posed a threat to widely used software. This sophisticated campaign tricks individuals into joining fake video calls with what appear to be familiar contacts. During these calls, victims are prompted to install malicious software, disguised as an audio fix, which then grants hackers access to their systems. This access allows the attackers to steal funds, take over accounts, and target the victim's contacts. Authorities seized cloud infrastructure used in the campaign and recovered more than 900 webcam videos of victims. The FBI also reported that hackers compromised a developer's computer, injecting malicious code into widely used software, though this attack was detected and stopped before widespread distribution. Separately, the Justice Department authorized the seizure of over $1.2 billion stolen from Binance, a cryptocurrency exch...
Rapid ReadRapid Read
Federal Authorities Disrupt Massive North Korean Cryptocurrency Theft Operations

Federal Authorities Disrupt Massive North Korean Cryptocurrency Theft Operations

Federal authorities have successfully disrupted extensive cryptocurrency theft operations attributed to North Korean military hackers, known as TraderTraitor. Law enforcement officials dismantled cloud-based infrastructure used in a North Korean social engineering campaign called FaceStealer, which had stolen over $400 million in the past 18 months. Additionally, federal agents secured court authorization to seize more than $1.2 billion in cryptocurrency stolen from the Binance exchange, part of a larger $6 billion theft attributed to TraderTraitor. Working with virtual asset service providers, authorities have frozen over $2.7 billion of the stolen Binance funds. The FaceStealer operation involved compromising victims' accounts to send deepfake video meeting invitations, recording webcams, and installing malware to steal cryptocurrency and hijack communication accounts.
Rapid ReadRapid Read
FBI Warns of North Korean 'FaceStealer' Operation Exploiting AI and Stolen Identities for Crypto Fraud

FBI Warns of North Korean 'FaceStealer' Operation Exploiting AI and Stolen Identities for Crypto Fraud

The Federal Bureau of Investigation (FBI) has issued a warning regarding a sophisticated North Korean cyber operation dubbed 'FaceStealer.' This operation has reportedly stolen over $400 million in cryptocurrency within 18 months and amassed more than 900 webcam recordings of victims. The hackers use these recordings, along with hijacked communication accounts and AI-generated videos, to impersonate individuals in counterfeit video meetings. They invite targets to what appear to be legitimate Zoom or Microsoft Teams meetings, often referencing established business relationships. During these fake meetings, attackers create a fabricated technical issue, prompting victims to install malware under the guise of a solution. This malware then harvests credentials, records keystrokes, captures screens, and establishes persistent access. The FBI notes that the operation has expanded to target maintainers of widely distributed open-source software, posing a significant supply-chain threat. The Department of Justice...
Rapid ReadRapid Read
North Korea's Lazarus Group Targets U.S. Servers in Global Cyberattack Campaign

North Korea's Lazarus Group Targets U.S. Servers in Global Cyberattack Campaign

The North Korea-linked hacking group Lazarus has been identified targeting 49 servers in the United States as part of a broader cyberattack campaign. This campaign exploits security vulnerabilities in the PHP programming language, specifically remote code execution (RCE) vulnerabilities (CVE-2026-109618, CVE-2026-109619) in PHP core running on Windows operating system environments. According to global threat intelligence firm CYFIRMA, the Lazarus ecosystem attackers used these vulnerabilities to target 581 servers globally between the 25th and 29th of last month. Of the 216 primary targets confirmed across 10 countries, the United States had the highest number of targeted servers. The attackers scouted targets in a closed online channel, specifically mentioning U.S. internet protocol (IP) ranges as 'quite promising' before launching full-scale attacks. The targeted sectors include government agencies, finance, telecommunications, and critical infrastructure providers.
Rapid ReadRapid Read
Social Engineering and Phishing Attacks Pose Persistent Threat to U.S. Workplaces

Social Engineering and Phishing Attacks Pose Persistent Threat to U.S. Workplaces

Social engineering and phishing continue to be prevalent threats in U.S. workplaces, manipulating individuals into divulging confidential information or performing unsafe actions. Social engineering encompasses a broad range of tactics, including pretexting, baiting, impersonation, and tailgating, which can occur through various channels like phone calls, in-person requests, or digital messages. Phishing, a specific type of social engineering, uses deceptive communications or websites to trick targets into sharing information, sending money, or opening malicious links. The FBI's 2025 Internet Crime Report recorded 191,561 phishing or spoofing complaints and 24,768 business email compromise (BEC) complaints, with reported BEC losses around $3.05 billion. These attacks often leverage urgency, impersonation of trusted contacts (like IT support or managers), or appealing offers to bypass normal security protocols. Modern techniques, including AI-generated audio and messages, are making these attacks more convi...
Rapid ReadRapid Read
FBI Disrupts North Korean FaceStealer Cryptocurrency Theft Scheme, Seizing Victim Videos and Recovering Funds

FBI Disrupts North Korean FaceStealer Cryptocurrency Theft Scheme, Seizing Victim Videos and Recovering Funds

The FBI and Department of Justice (DOJ) have announced the disruption of cloud-based infrastructure used by North Korean cyber actors in a sophisticated cryptocurrency theft scheme known as FaceStealer. This operation led to the seizure of over 900 webcam videos of victims working in the crypto and Web3 industries globally. The FaceStealer scheme involves highly tailored social engineering campaigns where threat actors compromise and secretly record victims' webcams. They then hijack communication accounts to message contacts, delivering convincing fake video links to new targets and luring them into imposter video chats. This activity is attributed to North Korean hacking groups such as Sapphire Sleet, UNC1069, Stardust Chollima, APT38, and BlueNoroff. These groups have aggressively targeted companies and individuals in the cryptocurrency and Web3 sectors, resulting in the theft of over $400 million in the last 18 months leading up to the disruption. The actors are increasingly focusing on open-source sof...
AP NewsAP News
FBI says US has seized $1.2 billion worth of cryptocurrency stolen from Binance

FBI says US has seized $1.2 billion worth of cryptocurrency stolen from Binance

The FBI says it has seized or restrained more than $1.2 billion of cryptocurrency reported stolen last month from Binance
ReutersReuters
North Korean hackers steal more than $400 million using video images, FBI says

North Korean hackers steal more than $400 million using video images, FBI says

By AJ Vicens Nov 12 (Reuters) - North Korean state-backed hackers have stolen more than $400 million in cryptocurrency over the past 18 months using surreptitiously recorded images of people which are then used to target their contacts, the FBI said Thursday.
Rapid ReadRapid Read
Richmond Public Schools Confirms Personal Data Posted on Dark Web Following Cyberattack

Richmond Public Schools Confirms Personal Data Posted on Dark Web Following Cyberattack

Richmond Public Schools (RPS) announced that personal information belonging to current and former students, staff, and contractors has been posted on the dark web. This confirmation follows a cybersecurity breach that occurred last month, which caused servers and operational systems across the district to go offline. The compromised data potentially includes sensitive details such as names, birth dates, phone numbers, addresses, driver’s license numbers, Social Security numbers, passport numbers, military identification numbers, health insurance numbers, and some medical information related to educational or employment needs. The division's Chief Operating Officer, Patrick Herrel, stated that a forensic audit is underway, and RPS is cooperating with federal officials, including the FBI’s Cyber Crimes Division, the Virginia State Police’s Virginia Cyber Fusion Center, and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency. The incident initially disrupted basic school fun...