[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-rXuxAbL4e29DtfAKZ57ltmzpjnPCRqIQbPG8BPXwRs":3},{"article":4,"iocs":46,"watch_terms":50,"solutions":51,"lesson":108},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"f5b696f7-ecb4-49c8-9c7c-4c930040a707","Feds announce seizure of $1.2 billion from Binance theft; also takedown of ‘FaceStealer’ tools","feds-announce-seizure-of-1-2-billion-from-binance-theft-also-takedown-of-faceste-020706","The Department of Justice and FBI announced two separate actions in response to North Korea-linked cryptocurrency theft operations.","The U.S. Department of Justice and FBI announced the seizure of over $1.2 billion in cryptocurrency stolen from Binance, attributed to the North Korean hacking group TraderTraitor. Additionally, the FBI disrupted cloud infrastructure used by North Korean hackers for a social engineering campaign called 'FaceStealer,' which stole over $400 million in cryptocurrency using malware delivered via malicious video conference links and deepfakes.","US seizes $1.2B from Binance theft and disrupts North Korean 'FaceStealer' tools.","https:\u002F\u002Ftherecord.media\u002Fstolen-binance-crypto-recovered-doj-facestealer-disrupted","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002Fdoj_logo_green_code_f20ed46844.jpg","2026-11-12T21:42:00+00:00","2026-11-12T22:00:11.946856+00:00",9,[17,20],{"name":18,"type":19},"TraderTraitor","threat_actor",{"name":21,"type":22},"Binance","vendor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":23,"icon":25,"name":26,"slug":27},null,"Nation-state","nation-state",[29,34,36,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47],{"type":40,"value":48,"context":49},"FaceStealer","Tools used by North Korean hackers for social engineering campaigns.",[21],{"controls":52,"vendors":107},[53,81],{"slug":45,"name":54,"problem":55,"products":56},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"slug":82,"name":83,"problem":84,"products":85},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":103,"product_name":104,"url":105,"description":106},"ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",[],{"slug":109,"title":110,"body":111,"framework_refs":112,"framework_notes":118},"north-korean-hackers-steal-16b-via-social-engineering-and-deepfakes","North Korean Hackers Steal $1.6B via Social Engineering and Deepfakes","The TraderTraitor group, linked to North Korea, executed two massive cryptocurrency thefts totaling over $1.6 billion by exploiting human trust rather than purely technical vulnerabilities. The FaceStealer campaign used deepfake video calls and malicious meeting links to deceive victims into installing malware, demonstrating that even sophisticated organizations can be compromised when employees lack awareness of advanced social engineering tactics. Cryptocurrency platforms and their employees were targeted precisely because high-value assets combined with human susceptibility create an irresistible attack surface. This matters because nation-state actors are now weaponizing AI-generated deception at scale, making traditional security training insufficient without specific guidance on deepfake and impersonation threats.",[113,114,115,116,117],"MITRE ATT&CK T1566: Phishing","MITRE ATT&CK T1656: Impersonation","NIS2 Article 21(2)(g)","NIS2 Article 21(2)(j)","CIS Control 14: Security Awareness and Skills Training (v8)",{"NIS2 Article 21(2)(g)":119,"NIS2 Article 21(2)(j)":120,"MITRE ATT&CK T1566: Phishing":121,"MITRE ATT&CK T1656: Impersonation":122,"CIS Control 14: Security Awareness and Skills Training (v8)":123},"This point requires basic cyber hygiene and staff training, which would have equipped employees to recognize and resist deepfake-based social engineering attacks.","Mandatory multi-factor authentication and secured communications channels would have limited attackers' ability to authenticate and execute fraudulent transactions even after credential theft.","FaceStealer delivered malware through malicious video conference links, a phishing delivery mechanism this technique specifically covers.","Attackers used deepfakes to impersonate trusted individuals during video calls to manipulate victims into installing malware or approving transfers.","Structured, role-specific training on social engineering and emerging threats like deepfakes directly addresses the human vulnerability exploited in the FaceStealer campaign."]