[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3Tmut5OYr_RV7ookzAZNfTlVQQVZFpHtA_lntgeauuA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":50},"5c57e170-5274-4c1c-9bd0-f5b4346406be","north-korean-social-engineering-campaign-steals-12b-via-fake-meetings-and-account-hijacking","1ac26fe3-2784-45ac-b486-b9a008e299fc","North Korean Social Engineering Campaign Steals $1.2B via Fake Meetings and Account Hijacking","North Korean state-sponsored hackers (TraderTraitor) exploited human trust by impersonating legitimate contacts on LinkedIn and Telegram, luring victims into fake video calls hosted on typosquatted domains to harvest credentials and webcam footage. The stolen recordings were then weaponized to impersonate victims in follow-on attacks, enabling the theft of over $1.2 billion from Binance alone and $6 billion in total virtual assets. This attack chain succeeded primarily because users lacked the awareness to verify meeting links and counterparties before engaging, and because account recovery and access controls were insufficient to prevent hijacked accounts from being used as launchpads. The scale of the operation highlights how social engineering against individuals can cascade into catastrophic financial losses for large institutions.","**Immediate actions:**\n- Train all employees and users to verify meeting links independently by navigating directly to the official platform rather than clicking links from chat messages.\n- Enable multi-factor authentication (MFA) on all corporate and personal accounts used for professional communication, especially Telegram, LinkedIn, and crypto platforms.\n- Deploy domain monitoring tools to detect typosquatted versions of your organization's domains and block access to known lookalike URLs.\n\n**Long-term improvements:**\n- Establish a mandatory out-of-band verification process before any user transfers funds, approves transactions, or shares credentials based on a request received via chat or video call.\n- Implement privileged access controls and behavioral anomaly detection on cryptocurrency exchange accounts to flag unusual login locations or high-value transaction patterns.\n- Conduct regular social engineering simulations targeting employees with access to financial systems or high-value accounts.\n\n**Detection measures:**\n- Monitor for account access from new devices or geographies and require step-up authentication before allowing sensitive actions.\n- Log and alert on the creation of or access to meeting links from unrecognized or external domains within corporate communication tools.",[12,13,14,15,16],"MITRE ATT&CK T1566: Phishing","MITRE ATT&CK T1517: Access Notifications","NIS2 Article 21(2)(g)","NIS2 Article 21(2)(j)","CIS Control 14: Security Awareness and Skills Training (v8)",{"NIS2 Article 21(2)(g)":18,"NIS2 Article 21(2)(j)":19,"MITRE ATT&CK T1566: Phishing":20,"MITRE ATT&CK T1517: Access Notifications":21,"CIS Control 14: Security Awareness and Skills Training (v8)":22},"The attack succeeded largely through manipulation of users who lacked sufficient cyber hygiene training to recognize fake meeting invitations and typosquatted domains, which this NIS2 point directly requires organizations to address.","The hijacking of Telegram and LinkedIn accounts could have been prevented or limited by mandatory multi-factor authentication and secured communication channels, which this NIS2 point explicitly requires.","The attackers used spear-phishing via LinkedIn and Telegram to initiate contact and lure victims to fraudulent video meeting links, which is the core technique this ATT&CK item covers.","Hijacked accounts on messaging platforms were used to impersonate victims and pivot to further targets, consistent with adversarial abuse of account access on mobile and communication platforms.","Victims were socially engineered through convincing but detectable pretexts; structured security awareness training targeting phishing and impersonation tactics is exactly what this control mandates to reduce human-layer risk.","published","2026-11-13T01:20:21.789756+00:00","2026-11-13T01:20:21.778+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fcyberscoop.com\u002Fus-seizes-north-korea-hacking-infrastructure-binance\u002F","us-seizes-north-korean-hacking-infrastructure-1-2-billion-in-cryptocurrency-stol-46736a","US seizes North Korean hacking infrastructure, $1.2 billion in cryptocurrency stolen from Binance",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[44],{"id":45,"date":46,"edition":47,"title":48,"audio_url":49},"60bd5b1f-0d67-497d-803c-f69a4d33511d","2026-11-13","morning","ThreatNoir Morning Brief — November 13","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-11-13\u002Fthreatnoir-morning-brief-2026-11-13.mp3",[51,55,59],{"slug":52,"name":53,"problem":54},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":56,"name":57,"problem":58},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":60,"name":61,"problem":62},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]