- Arctic Wolf has identified 40 videos of the deepfakes used by the hackers themselves and suspected another 23.
- The hackers have created baits for 677 people from 58 countries, and 84 percent of them are company founders and executives.
- For the attack to be successful, the victim still needs to run a command.
North Korea-linked hackers are using images and voice samples of actual company founders and CEOs to carry out attacks. They get the materials from publicly available YouTube interviews and keynote speeches during conferences. They then embed the clips into fake video meetings.
US cybersecurity firm Arctic Wolf revealed the details in a November 12 report. Arctic Wolf identified the group behind this hacking campaign as BlueNoroff. According to the firm, BlueNoroff is a financially motivated subgroup of the Lazarus Group of North Korea.
How the Attackers Create the Fakes
Arctic Wolf was able to access what is inside the hackers’ own media library, which has over 1,670 files. Many of those files are screen recordings of online interviews and conference speeches.
Some file names give the trick away, for example: “Blockchain Interviews.mp4.” As a result, they don’t need to hack the target anymore. A public video is enough to deliver a fake call.
The tools were quite typical. Arctic Wolf found Grok Imagine, Generative AI from Wondershare, and GPT-4o by OpenAI. Besides that, they discovered a tool from ByteDance. This tool was the first non-Western generator among the lot. Arctic Wolf counted 122 AI files altogether made using seven tools.
Arctic Wolf didn’t judge the videos by just viewing it, rather, it paid attention to the metadata. They also saw built-in labels showing the videos were made with AI. This technique allowed the analysts to confirm 40 deepfakes. After a visual check, the analysts also found 23 more. The company states that 40 is just a minimum number since some files do not contain any metadata.
The quality has also improved. In April, the cybercriminals simply added AI faces onto already existing images through Adobe Premiere Pro. The videos had noticeable defects.
On the contrary, videos from June and September show no defects whatsoever. The researchers noted that one couldn’t determine whether the videos were from a real webcam or fake by just looking at them.
Who are the Victims?
The documents list 677 people. As of April, there were around 400. They hail from 58 different countries, as opposed to just above 20 before. The US has the most. Founders and C-suite executives account for 84% of these victims. The rest work mostly in crypto, Web3, finance, and venture capitals. Gaming, AI and media professionals are part of it too.
Do not miss this number. It denotes who the hackers prepared the material for. Still, it does not mean that many people were hacked. Regardless, Arctic Wolf insists the number is smaller than the actual one.
It is a self-reproducing scheme. Hackers record the victims through the webcams. They also use Telegram sessions to get access to the victim’s contact list. Then, they use footage to fake a Zoom meeting with the next victim. Indeed, out of 100 initial targets, 36 of them have had the stolen footage of themselves stored on the hackers’ server.
The attack usually begins with an invitation from someone the target trusts. The other ‘participants’ of the call are all fakes. The audio fails soon after the call starts. Then the victim will see a pop-up window providing a quick fix for the problem. As such, the victim copy and pastes the command without knowing they’ve just installed malware.
The Scheme Goes Beyond Zoom
Hackers no longer need to meet in person. Lately, Arctic Wolf has discovered at least eight new bait types. They involve fake updates for PDF viewers, a fictitious media player named NovaStream, ID verification and wallet services. The fundamentals remain consistent. Hackers gain the target’s trust, simulate a problem, then create a solution that the target has to implement.
AI simplifies the work but does not run the operation. The main work collection of material, selection, and editing always needs human input. In fact, Arctic Wolf compares the AI technologies to stock software used by small media companies.
The company makes three predictions, which it calls assessments purely. One: the fake participants will start replying back. At present, none of the participants ever replies to the victim. The implementation of live face-swapping might change that game.
Two: new bait types will follow the working hours of their creator, like e-signature or data rooms. Three: the labels that signal the presence of AI content might miss a lot of fakes, as a number of its types do not produce the labels.
How to Protect Yourself
The misuse of publicly available images also raises concerns beyond corporate cyberattacks. Australian schools have been told to remove student photos over AI deepfake risks, highlighting the growing need to protect personal images from being misused to create fake content.
Arctic Wolf offers the following advice:
- Consider any prompt to execute a command, script, or file suspicious. Legitimate conference and document services will not make such a request.
- Validate any unusual requests with a different communication method, e.g., a phone number you are already familiar with.
- Examine the web address letter by letter. Fraudulent websites use names like ‘teams-live.vip’.
- If you have already executed the command, immediately stop it. Save the link and file on another device and notify your security team. Then, log out of all Telegram sessions and change the saved passwords.
Share this article
About the Author
Farwa is an experienced InfoSec writer and cybersecurity journalist skilled in writing articles related to cybersecurity, AI, DevOps, Big Data, Cloud security, VPNs, IAM, and Cloud Computing. Also a contributor on Tripwire.com, Infosecurity Magazine, Security Boulevard, DevOps.com, and CPO Magazine.
More from Farwa SajjadRelated Posts
Viral UK Privacy Claim Falsely Says Ofcom Will Collect Home Wi-Fi Passwords
A viral post says UK households must register their Wi-Fi passwords with the regulator Ofcom. The po...
UK Messenger Case Puts Encrypted Chat Privacy and Automated Image Checks Under Scrutiny
A British man was reportedly arrested after Facebook flagged an image he sent to his wife on Messeng...
York University Confirms Data Breach Exposing Personal Information Dating Back to 2007
York University indicates that an unauthorized person compromised personal information from digital ...
Hackers Use Hijacked WhatsApp Accounts to Spread Malware Disguised as Invoices
Cybersecurity agencies in Malaysia and Singapore warn about malware files sent through hacked WhatsA...
Apple Warns German Ministers and Lawmakers of Possible iPhone Spyware Attacks
Apple started sending spyware alerts to German ministers and lawmakers on October 29, and Germany...
Germany’s Charité Hospital Breach Exposes Names and Emails of 140,000 People
Hackers attacked the Charité webpage server and stole confidential information, including the names ...
