Threat video1:00
TraderTraitor FaceStealer Deepfake Lures: Detection & IOCs
APT38-attributed FaceStealer lures victims into deepfake Zoom and Teams meetings; 9 detection rules, 24 IOCs and a free Splunk SPL rule cover it.
Read the full threat intel for TraderTraitor FaceStealer Deepfake Lures: Detection & IOCs →
Chapters
- 0:00The hookCrypto-industry employee endpoints: 18 indicators.
- 0:04The storyFBI and DOJ disrupted cloud infrastructure behind 'FaceStealer'.
- 0:15Attack pathIn a lab reproduction: Register look-alike meeting domains.
- 0:26AttributionAttributed to APT38.
- 0:30Indicators of compromise18 indicators to hunt: 4 IPs, 6 domains and 3 SHA-256 hashes, and more.
- 0:38MITRE ATT&CK techniques17 ATT&CK techniques, from resource development to impact.
- 0:43Remediation5 steps now: Treat unsolicited Calendly/Zoom/Teams invitations to crypto and open-source staff.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Crypto-industry employee endpoints: 18 indicators.
0:05FBI and DOJ disrupted cloud infrastructure behind 'FaceStealer'.
0:10The FBI/DOJ announcement published no domains, IPs or hashes.
0:16In a lab reproduction: Register look-alike meeting domains.
0:20Take over prior victims' accounts.
0:22Send Calendly meeting invitation.
0:26Attributed to APT38. Confidence: high.
0:3018 indicators to hunt: 4 IPs, 6 domains and 3 SHA-256 hashes, and more.
0:3917 ATT&CK techniques, from resource development to impact.
0:435 steps now: Treat unsolicited Calendly/Zoom/Teams invitations to crypto and open-source staff.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.