[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f79LfDVqiNbU8pZkebx5LV3LkQ_eYuydnLQf0CPVFyyY":3},{"article":4,"iocs":50,"watch_terms":54,"solutions":55,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"f93fbae7-0e0f-479e-858c-b43c086b4992","North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure","north-korea-s-crypto-theft-operations-doj-seizes-1-2-billion-and-disrupts-hacker-6ebed0","The DOJ seized over $1.2 billion from North Korea ‘s Binance theft, and says the same hackers are targeting open-source developers The U.S. Department of Justice announced two separate but connected actions against North Korea ‘s cryptocurrency theft operations. The press release covers the seizure of infrastructure behind a social engineering scheme called FaceStealer and […]","The U.S. Department of Justice announced actions against North Korea's cryptocurrency theft operations, seizing over $1.2 billion in stolen funds from Binance and disrupting infrastructure used in the FaceStealer social engineering scheme. The FaceStealer scheme, which has stolen over $400 million, uses AI-generated deepfakes and social engineering to trick victims into installing malware. The same North Korea-linked actors, also known as Sapphire Sleet and APT38, are now targeting open-source developers.","DOJ seizes $1.2B in crypto, disrupts North Korean hacker infrastructure and FaceStealer scheme.","https:\u002F\u002Fsecurityaffairs.com\u002F203012\u002Fcyber-crime\u002Fnorth-korea-crypto-theft-operations-doj-seizes-1-2-billion-and-disrupts-hacker-infrastructure.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2015\u002F03\u002Fnorth-korea-hackers.jpg","2026-11-13T21:19:30+00:00","2026-11-13T22:00:27.057933+00:00",8,[17,20,22,24],{"name":18,"type":19},"Sapphire Sleet","threat_actor",{"name":21,"type":19},"BlueNoroff",{"name":23,"type":19},"APT38",{"name":25,"type":26},"Binance","vendor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":27,"icon":29,"name":30,"slug":31},null,"Nation-state","nation-state",[33,38,40,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51],{"type":44,"value":52,"context":53},"FaceStealer","Social engineering scheme used by North Korean hackers",[25],{"controls":56,"vendors":139},[57,86,112],{"slug":58,"name":59,"problem":60,"products":61},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":87,"name":88,"problem":89,"products":90},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":108,"product_name":109,"url":110,"description":111},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":113,"name":114,"problem":115,"products":116},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[117,125,132],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":126,"product_name":129,"url":130,"description":131},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":113,"product_name":136,"url":137,"description":138},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[],{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":150},"north-korean-actors-use-ai-deepfakes-and-social-engineering-to-steal-12b-in-crypto","North Korean Actors Use AI Deepfakes and Social Engineering to Steal $1.2B in Crypto","North Korea-linked threat actors (Sapphire Sleet\u002FAPT38) successfully stole over $1.2 billion in cryptocurrency by exploiting the weakest link in security: human trust. The FaceStealer scheme leveraged AI-generated deepfakes and sophisticated social engineering to trick victims into installing malware, bypassing technical controls entirely. Critically, these same actors are now targeting open-source developers, poisoning the software supply chain and threatening organizations that consume community-built tools. This incident demonstrates that even technically sophisticated environments can be compromised when users are unprepared to recognize AI-enhanced deception. As deepfake technology becomes more accessible, the credibility of social engineering attacks will only increase, making human-layer defenses a top priority.",[145,146,147,148,149],"MITRE ATT&CK T1566: Phishing","MITRE ATT&CK T1195: Supply Chain Compromise","NIS2 Article 21(2)(g)","NIS2 Article 21(2)(d)","CIS Control 14: Security Awareness and Skills Training (v8)",{"NIS2 Article 21(2)(d)":151,"NIS2 Article 21(2)(g)":152,"MITRE ATT&CK T1566: Phishing":153,"MITRE ATT&CK T1195: Supply Chain Compromise":154,"CIS Control 14: Security Awareness and Skills Training (v8)":155},"This point mandates supply chain security measures, which would require vetting open-source dependencies and developer toolchains targeted by the North Korean actors.","This point requires organizations to maintain basic cyber hygiene and security training, which would directly address employees' ability to recognize AI-generated deepfakes and social engineering lures.","FaceStealer relied on phishing-style social engineering — including AI deepfakes — to deliver malware, which is precisely the initial access technique this ATT&CK entry covers.","Targeting open-source developers to inject malicious code into widely-used repositories is a textbook supply chain compromise, the technique this ATT&CK entry describes.","CIS Control 14 requires organizations to build and maintain a security awareness program that equips users to identify and resist social engineering attacks like the AI deepfake schemes used in FaceStealer."]