[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhy342OMIljKr7h04rOtTqk9_HbDUKPiOhg_kTB6vDno":3},{"article":4,"iocs":54,"watch_terms":58,"solutions":59,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"1ac26fe3-2784-45ac-b486-b9a008e299fc","US seizes North Korean hacking infrastructure, $1.2 billion in cryptocurrency stolen from Binance","us-seizes-north-korean-hacking-infrastructure-1-2-billion-in-cryptocurrency-stol-46736a","The infrastructure, said to belong to APT38, contained footage used to fool victims over video calls. The post US seizes North Korean hacking infrastructure, $1.2 billion in cryptocurrency stolen from Binance appeared first on CyberScoop.","The Justice Department announced coordinated actions against North Korean hacking groups, seizing cloud infrastructure used in the FaceStealer social engineering scheme and authorizing the seizure of over $1.2 billion in cryptocurrency stolen from Binance. The FBI attributes the larger operation, involving over $6 billion in stolen virtual assets, to North Korean military hackers known as TraderTraitor. The scheme involves hijacking accounts on platforms like Telegram and LinkedIn to lure victims into fake video meetings via typo-squatted domains, using secretly recorded webcam videos to impersonate victims in follow-on attacks.","US seizes North Korean hacking infrastructure and over $1.2B in crypto stolen from Binance.","https:\u002F\u002Fcyberscoop.com\u002Fus-seizes-north-korea-hacking-infrastructure-binance\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2019\u002F01\u002Fnorthkorea_cloth_flag.jpg","2026-11-13T00:32:19+00:00","2026-11-13T01:00:34.357955+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"APT38","threat_actor",{"name":21,"type":19},"TraderTraitor",{"name":23,"type":19},"Sapphire Sleet",{"name":25,"type":19},"BlueNoroff",{"name":27,"type":19},"Stardust Chollima",{"name":29,"type":30},"Binance","vendor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":31,"icon":33,"name":34,"slug":35},null,"Nation-state","nation-state",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":48,"value":56,"context":57},"FaceStealer","Social engineering scheme behind the seized infrastructure.",[29],{"controls":60,"vendors":142},[61,90,116],{"slug":62,"name":63,"problem":64,"products":65},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":91,"name":92,"problem":93,"products":94},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":112,"product_name":113,"url":114,"description":115},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":117,"name":118,"problem":119,"products":120},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[121,128,134],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":122,"product_name":125,"url":126,"description":127},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":129,"product_name":130,"url":132,"description":133},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":153},"north-korean-social-engineering-campaign-steals-12b-via-fake-meetings-and-account-hijacking","North Korean Social Engineering Campaign Steals $1.2B via Fake Meetings and Account Hijacking","North Korean state-sponsored hackers (TraderTraitor) exploited human trust by impersonating legitimate contacts on LinkedIn and Telegram, luring victims into fake video calls hosted on typosquatted domains to harvest credentials and webcam footage. The stolen recordings were then weaponized to impersonate victims in follow-on attacks, enabling the theft of over $1.2 billion from Binance alone and $6 billion in total virtual assets. This attack chain succeeded primarily because users lacked the awareness to verify meeting links and counterparties before engaging, and because account recovery and access controls were insufficient to prevent hijacked accounts from being used as launchpads. The scale of the operation highlights how social engineering against individuals can cascade into catastrophic financial losses for large institutions.",[148,149,150,151,152],"MITRE ATT&CK T1566: Phishing","MITRE ATT&CK T1517: Access Notifications","NIS2 Article 21(2)(g)","NIS2 Article 21(2)(j)","CIS Control 14: Security Awareness and Skills Training (v8)",{"NIS2 Article 21(2)(g)":154,"NIS2 Article 21(2)(j)":155,"MITRE ATT&CK T1566: Phishing":156,"MITRE ATT&CK T1517: Access Notifications":157,"CIS Control 14: Security Awareness and Skills Training (v8)":158},"The attack succeeded largely through manipulation of users who lacked sufficient cyber hygiene training to recognize fake meeting invitations and typosquatted domains, which this NIS2 point directly requires organizations to address.","The hijacking of Telegram and LinkedIn accounts could have been prevented or limited by mandatory multi-factor authentication and secured communication channels, which this NIS2 point explicitly requires.","The attackers used spear-phishing via LinkedIn and Telegram to initiate contact and lure victims to fraudulent video meeting links, which is the core technique this ATT&CK item covers.","Hijacked accounts on messaging platforms were used to impersonate victims and pivot to further targets, consistent with adversarial abuse of account access on mobile and communication platforms.","Victims were socially engineered through convincing but detectable pretexts; structured security awareness training targeting phishing and impersonation tactics is exactly what this control mandates to reduce human-layer risk."]