- Published
- Source
- BleepingComputer
- Reported by
- 2 publishers
- Filed under
- Nation-state, Attacks
The U.S. government has disrupted a North Korean social engineering campaign called 'FaceStealer', responsible for stealing more than $400 million in cryptocurrency.
Defending against state-backed attackers
- Patch internet-facing devices first – VPNs, firewalls and email gateways are their usual way in.
- Hunt for the published indicators and techniques in your own logs, not just in your antivirus.
- Read the joint advisories: they name the products, the techniques and the signs to look for.
Also reported by 1 more publisher
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
Impersonation
StealthWhat a defender checks
- Confirm any change of payment details on a number you already hold – never the one in the message.
- Make the help desk verify identity before resetting passwords or MFA.
- Brief finance and help-desk staff on the current pretexts.
Build the skillBlue Team Analyst, Email & Phishing Investigation
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
Blue Team Specialist
Breaches like this get investigated, not just reported.
Blue Team Specialist takes the Analyst curriculum and adds the investigator's work: one incident owned end to end, hypothesis-led threat hunting with MITRE ATT&CK and KQL, breach analysis, and a root cause report people can act on.
- Scope, attacker path and dwell time
- Threat hunting with ATT&CK and KQL
- Root cause analysis and reporting
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.