[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fz9PQboOY78pjkC_w_MtTvFblWJhk_br2mk31Q50yOvc":3},{"article":4,"iocs":53,"watch_terms":57,"solutions":58,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"c6511bd9-7e0d-4d80-92b2-6df00e119f37","FBI Disrupts North Korean FaceStealer Scheme Behind $400M Crypto Theft","fbi-disrupts-north-korean-facestealer-scheme-behind-400m-crypto-theft-82acab","The FaceStealer scheme used hijacked messaging accounts, fake video meetings and secretly recorded webcam footage to target cryptocurrency…","The FBI has disrupted a North Korean cybercrime operation dubbed FaceStealer, which stole over $400 million in cryptocurrency in 18 months. The scheme involved hijacked messaging accounts, fake video meetings, and secretly recorded webcam footage to trick victims into running malicious commands that installed malware for data collection and long-term access. The operation also targeted open-source developers to gain access to repositories.","FBI disrupts North Korean FaceStealer scheme, stealing over $400M in crypto.","https:\u002F\u002Fhackread.com\u002Ffbi-disrupts-north-korean-facestealer-crypto-theft\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Ffbi-disrupts-north-korean-facestealer-crypto-theft.jpg","2026-11-13T14:17:17+00:00","2026-11-13T15:01:20.472811+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"North Korean hackers","threat_actor",{"name":21,"type":19},"UNC1069",{"name":23,"type":19},"APT38",{"name":25,"type":19},"BlueNoroff",{"name":27,"type":19},"Sapphire Sleet",{"name":29,"type":19},"TraderTraitor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":47,"value":55,"context":56},"FaceStealer","Name of the malware\u002Fscheme used by North Korean hackers.",[],{"controls":59,"vendors":142},[60,89,115],{"slug":61,"name":62,"problem":63,"products":64},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":90,"name":91,"problem":92,"products":93},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[94,99,107],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":95,"product_name":96,"url":97,"description":98},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":116,"name":117,"problem":118,"products":119},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[120,127,134],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":116,"product_name":124,"url":125,"description":126},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":128,"product_name":131,"url":132,"description":133},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":153},"north-korean-facestealer-social-engineering-and-open-source-compromise-fuel-400m-crypto-theft","North Korean FaceStealer: Social Engineering and Open-Source Compromise Fuel $400M Crypto Theft","The FaceStealer operation succeeded primarily because victims were manipulated through convincing social engineering — fake video meetings, hijacked messaging accounts, and fabricated trust — into executing malicious commands themselves, bypassing technical defenses entirely. By also targeting open-source developers and their repositories, the attackers embedded a supply chain threat capable of reaching far beyond individual victims. This matters because no firewall or antivirus stops a user who has been psychologically convinced to run malware voluntarily. Organizations and individuals handling high-value assets like cryptocurrency must treat unsolicited collaboration requests and unusual technical instructions as high-risk threat vectors.",[148,149,150,151,152],"MITRE ATT&CK T1204: User Execution","MITRE ATT&CK T1195: Supply Chain Compromise","NIS2 Article 21(2)(g)","NIS2 Article 21(2)(d)","CIS Control 14: Security Awareness and Skills Training (v8)",{"NIS2 Article 21(2)(d)":154,"NIS2 Article 21(2)(g)":155,"MITRE ATT&CK T1204: User Execution":156,"MITRE ATT&CK T1195: Supply Chain Compromise":157,"CIS Control 14: Security Awareness and Skills Training (v8)":158},"The targeting of open-source repositories to reach downstream victims falls squarely within what NIS2 Article 21(2)(d) addresses — security risks in the supply chain between entities and their suppliers or service providers.","The scheme exploited a lack of cyber hygiene and user awareness training; NIS2 Article 21(2)(g) specifically requires organizations to implement basic cyber hygiene practices and cybersecurity training to counter exactly this type of social engineering.","FaceStealer's core technique relied on tricking victims into manually running malicious commands, which is precisely what T1204 describes — adversaries depending on user action to execute malicious code.","Targeting open-source developers to gain access to repositories is a textbook supply chain compromise, allowing malware to propagate to downstream users of those projects.","CIS Control 14 requires organizations to establish security awareness programs that specifically address social engineering and phishing, which were the primary vectors used to convince victims to execute malicious commands."]