# FaceStealer: DPRK (APT38-attributed) deepfake meeting social-engineering campaign disrupted by FBI/DOJ; $1.2B of stolen Binance crypto seized (TraderTraitor)

> FBI and DOJ disrupted cloud infrastructure behind 'FaceStealer', a North Korean (APT38-attributed) social-engineering campaign that stole over $400 million in crypto across 18 months using fake Calendly/Zoom/Teams meetings with pre-recorded and deepfake video to deliver malware. Separately, DOJ obtained authorization to seize or restrain more than $1.2 billion of the roughly $6.3 billion stolen from Binance, attributed by the FBI to TraderTraitor; the FBI says it is unclear whether FaceStealer was used in the Binance breach.

- **Published:** 2026-11-12T21:59:22Z
- **Last reviewed:** 2026-11-12T21:59:22Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5896
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5896.png
- **ID:** TL-2026-5896
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** APT38 (North Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (3 shown free below)

## Description

On 2026-11-12 The Record reported that the FBI and DOJ disrupted cloud infrastructure used by 'FaceStealer', a social-engineering scheme the FBI attributes to APT38 (BlueNoroff). Per the FBI, the campaign stole more than $400 million in cryptocurrency over 18 months. The FBI obtained a warrant to seize more than 900 webcam videos of victims, which the operators reused to simulate meeting participants.

Initial access is a Calendly invitation to a Zoom or Teams meeting, sent from accounts stolen from earlier victims. The link leads to a fake meeting domain that delivers malware and can compromise victims before they join. Inside the fake meeting the operators play pre-recorded videos of past victims and deepfakes (including of prominent crypto figures), then present a fake technical error (for example 'cannot be heard') with a 'fix' that installs malware. The FBI describes the payload as a browser cookie harvester, keyloggers, a screen capturer and a backdoor. After compromise the actors hijack the victim's Telegram, LinkedIn, Slack and Discord accounts and approach the victim's contacts, sometimes months later. Targets are crypto-industry employees and open-source developers; the FBI cited attempts against npm and Rust crate maintainers and an earlier attempt to lure a JavaScript library maintainer into a fake Teams call.

The FBI/DOJ announcement published no domains, IPs or hashes. Independent reporting by Arctic Wolf (2026-04-27) on a BlueNoroff fake-Zoom campaign shows the same pattern: Calendly invite, typosquatted Zoom/Teams lobby with pre-recorded or AI-generated participants, covert webcam capture, an 'SDK is deprecated' ClickFix prompt, a PowerShell implant beaconing every 5 seconds, Telegram session and Chromium data theft, a COM-elevation UAC bypass and Startup LNK persistence. Arctic Wolf found over 950 media files on the operator's server. That infrastructure is included as RELATED indicators; no source confirms it is the same infrastructure the FBI disrupted.

Separately, the FBI, US Secret Service and IRS-CI attributed the Binance theft (about $6.3 billion, on or about 2026-10-29) to TraderTraitor (also Jade Sleet, Pressure Chollima, UNC4899, Slow Pisces), based partly on commingling of Binance proceeds with funds stolen from Bitget and others. Binance first cited a compromised engineer laptop, later found additional points of breach, and its CEO said the attacker used a self-destruct mechanism that destroyed tooling and traces. DOJ obtained court authorization to seize or restrain more than $1.2 billion, part of about $2.7 billion frozen by crypto platforms. Laundering uses automated wallet hopping (about 12,000 wallets, 11 blockchains, roughly 40,000 transactions per Elliptic), conversion to ETH, worthless tokens through DEX liquidity pools, bridges, mixers, instant-swap services and Chinese money-laundering networks. The FBI published a list of attacker wallet addresses; they are not reproduced in the sources reviewed here. Elliptic cautions that static wallet lists will miss funds that reach a clean wallet hours later.

The FBI states it is unclear whether FaceStealer was used in the Binance breach. FBI reporting of the Binance intrusion cites trojanized Terraform providers and the FLATROOF/ROOFDECK malware as TraderTraitor tradecraft in general (via The Hacker News); that is not tied specifically to the Binance breach.

## MITRE ATT&CK

- T1583.001 Domains
- T1586.001 Social Media Accounts
- T1566.003 Spearphishing via Service
- T1195.002 Compromise Software Supply Chain
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1547.001 Registry Run Keys / Startup Folder
- T1548.002 Bypass User Account Control
- T1684.001 Impersonation
- T1055 Process Injection
- T1539 Steal Web Session Cookie
- T1555.003 Credentials from Web Browsers
- T1534 Internal Spearphishing
- T1113 Screen Capture
- T1125 Video Capture
- T1071.001 Web Protocols
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**FaceStealer / BlueNoroff ClickFix PowerShell Download Cradle (Fake Zoom SDK Fix) — Exploitation** (`TL-2026-5896-SPL-001`)

Detects the ClickFix execution step used by the DPRK APT38/BlueNoroff fake-meeting campaign (FaceStealer, TL-2026-5896): a user is told to paste a 'fix' or 'SDK update' command that runs PowerShell with an iwr/irm download piped to iex. Fires on the download-and-execute cradle when it carries the reported ZoomSDK user agent, /developer/sdk/update|fix/ URL pattern or a webzoom look-alike domain (e.g. uu03webzoom.us), or when it was started by a browser or explorer.exe (Run-dialog paste). Maps to T1204.004, T1059.001 and T1566.003. The lure indicators come from Arctic Wolf reporting on a related BlueNoroff campaign; the behavioural logic does not depend on them.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.004, T1059.001, T1566.003
- **Data sources:** sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1, DeviceProcessEvents, sigma: windows process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (Image="*powershell.exe" OR Image="*pwsh.exe") (CommandLine="*iwr *" OR CommandLine="*Invoke-WebRequest*" OR CommandLine="*irm *" OR CommandLine="*DownloadString*") (CommandLine="*| iex*" OR CommandLine="*|iex*" OR CommandLine="*Invoke-Expression*")
| eval lure_ioc=if(match(CommandLine,"(?i)ZoomSDK|/developer/sdk/(update|fix)/|[a-z]{2}[0-9]{2}webzoom"),1,0)
| eval browser_or_shell_parent=if(match(ParentImage,"(?i)(chrome|msedge|firefox|brave|explorer)[.]exe$"),1,0)
| where lure_ioc=1 OR browser_or_shell_parent=1
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images max(lure_ioc) as lure_ioc by host User
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ('powershell.exe','pwsh.exe')
| where ProcessCommandLine has_any ('iwr ','Invoke-WebRequest','irm ','DownloadString')
| where ProcessCommandLine has_any ('| iex','|iex','Invoke-Expression')
| extend LureIoc = ProcessCommandLine has_any ('ZoomSDK','/developer/sdk/update/','/developer/sdk/fix/','webzoom'), BrowserOrShellParent = InitiatingProcessFileName in~ ('chrome.exe','msedge.exe','firefox.exe','brave.exe','explorer.exe')
| where LureIoc or BrowserOrShellParent
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, LureIoc
```

### Sigma

```yaml
title: ClickFix PowerShell Download Cradle Impersonating Zoom SDK Update
id: 5f3a9c1e-7b24-4d8e-9a61-2c4e8b7d1f30
status: experimental
description: Detects PowerShell iwr/irm download cradles piped to iex that carry the ZoomSDK user agent, /developer/sdk/update|fix/ URL pattern or webzoom look-alike domains, or that were launched by a browser or explorer.exe. Associated with BlueNoroff/APT38 fake Zoom/Teams meeting ClickFix lures (TL-2026-5896 FaceStealer).
references:
  - https://therecord.media/stolen-binance-crypto-recovered-doj-facestealer-disrupted
  - https://arcticwolf.com/resources/blog/bluenoroff-uses-clickfix-fileless-powershell-and-ai-generated-zoom-meetings-to-target-web3-sector/
author: Threadlinqs Team
date: 2026-11-12
tags:
  - attack.execution
  - attack.t1204.004
  - attack.t1059.001
  - attack.initial-access
  - attack.t1566.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_download:
    CommandLine|contains:
      - 'iwr '
      - 'Invoke-WebRequest'
      - 'irm '
      - 'DownloadString'
  selection_exec:
    CommandLine|contains:
      - '| iex'
      - '|iex'
      - 'Invoke-Expression'
  selection_lure:
    CommandLine|contains:
      - 'ZoomSDK'
      - '/developer/sdk/update/'
      - '/developer/sdk/fix/'
      - 'webzoom'
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\explorer.exe'
  condition: selection_img and selection_download and selection_exec and (selection_lure or selection_parent)
falsepositives:
  - Administrators or developers who run install one-liners (iwr | iex) from a Run dialog or terminal
  - Legitimate software bootstrap scripts that use a download cradle
level: high
```

**Known false positives:**

- Administrators or developers running legitimate install one-liners (for example package-manager bootstrap scripts) via iwr | iex
- Internal software deployment scripts that launch from explorer.exe and use a PowerShell download cradle

**Tuning notes:** Allowlist known internal bootstrap hosts and signed deployment script paths by excluding on destination host in CommandLine. Raise priority when lure_ioc=1 (ZoomSDK / sdk/update path / webzoom domain) or when the host user is a crypto or open-source maintainer. Requires Sysmon EventCode 1 with full command-line capture or Defender for Endpoint.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Connections to Fake Zoom/Teams/Meet Meeting Lure Domains — Exploitation (locked: unlock with TL Creds)
- BlueNoroff Startup LNK Persistence, Stage Files and COM-Elevation UAC Bypass — Post-Exploitation (locked: unlock with TL Creds)
- Proxy/Firewall Traffic to FaceStealer-Related C2 and Exfiltration Paths — C2 (locked: unlock with TL Creds)
- Fake Microsoft Teams Meeting Installer (Teams_Installer.exe) Run From User-Writable Path — Exploitation (locked: unlock with TL Creds)
- Remote Thread Injection Into Browser Process From Script Host or User-Writable Binary — Post-Exploitation (locked: unlock with TL Creds)
- DNS Resolution of Related BlueNoroff and Community C2/Exfiltration Domains — C2 (locked: unlock with TL Creds)
- Non-Browser Access to Chromium Cookie/Credential Stores or Telegram tdata — Post-Exploitation (locked: unlock with TL Creds)
- PowerShell Implant Beaconing to Related BlueNoroff/Community C2 Infrastructure — C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 24)

Defanged, TLP:CLEAR.

- IP address: `83.136.208[.]246`
- Domain: `uu03webzoom[.]us`
- File hash: `dd1c72823f933952619cbb86aaeaea43057a259e9a0c9e3b11c82225ec3faaa1`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Feds announce seizure of $1.2 billion from Binance theft; also takedown of 'FaceStealer' tools](https://therecord.media/stolen-binance-crypto-recovered-doj-facestealer-disrupted)
- [FBI links North Korea's TraderTraitor to Binance theft (The Hacker News)](https://thehackernews.com/2026/11/fbi-links-north-koreas-tradertraitor-to.html)
- [FBI blames TraderTraitor for Binance hack (The Record)](https://therecord.media/fbi-blames-tradertraitor-for-binance-hack)
- [FBI alert: North Korea responsible for $6 billion Binance attack](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack)
- [BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector (Arctic Wolf)](https://arcticwolf.com/resources/blog/bluenoroff-uses-clickfix-fileless-powershell-and-ai-generated-zoom-meetings-to-target-web3-sector/)
- [North Korean Hackers Target Crypto Firms with ClickFix and AI-Made Zoom Lures (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/bluenoroff-dprk-hackers-target/)
- [BlueNoroff deepfake Zoom scam hits crypto firms (The Hacker News)](https://thehackernews.com/2025/06/bluenoroff-deepfake-zoom-scam-hits.html)
- [FBI blames North Korea for record $6.3bn crypto heist from Binance (Al Jazeera)](https://www.aljazeera.com/amp/news/2026/11/1/fbi-blames-north-korea-for-record-6-3bn-crypto-heist)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5896