The FBI and Arctic Wolf have disrupted infrastructure linked to BlueNoroff, a North Korean cyber group.
The operation focused on a social engineering scheme known as FaceStealer, which the FBI says targets leaders in cryptocurrency, fintech and Web3. Arctic Wolf's Adversary Operations team spent months tracking the group's activity and sharing intelligence with the bureau.
BlueNoroff is described as a threat group aligned with the Democratic People's Republic of Korea. Over the past six months, the campaign has broadened, with attackers moving beyond fake Zoom calls into other forms of business interaction that appear routine and credible.
That shift matters for Australia, which ranks in the top 10 by volume of targets identified by Arctic Wolf. The research cited 677 individuals across 58 countries, 84% of them founders or C-suite executives.
Expanded tactics
Arctic Wolf says the group now impersonates document-sharing tools, media players, identity checks and security audits, in addition to staging fake meetings. The aim remains the same: persuading senior people with access and authority to take an action that leads to compromise.
Arctic Wolf also verified 40 deepfake videos created from stolen webcam footage and public interviews. It said two of those videos could not be distinguished from real webcam footage by eye.
More than 1,670 files were found on an attacker-controlled server, and 1,202 of them linked to a tracked target. The findings suggest a broad, methodical effort to profile individuals and tailor approaches to them.
For companies in Australia's digital asset and financial technology sectors, the research points to a threat aimed at senior decision-makers rather than only technical staff. Founders, investors and executives with authority over transactions, systems access or sensitive information appear to be central targets.
Justin Moore, Director of Adversary Operations at Arctic Wolf, described a marked change in the campaign's reach and methods.
“Arctic Wolf is proud to have partnered with the FBI in identifying and disrupting BlueNoroff, a sophisticated North Korean threat group and part of a social engineering scheme the FBI calls 'FaceStealer'. 'FaceStealer' targets leaders across the cryptocurrency, fintech and Web3 industries. Our Adversary Operations team has spent months tracking the group's activity and sharing intelligence with the FBI to support this action.
“What we've seen over the last six months is a significant evolution in both the scale and sophistication of this operation. When we first published our April research on BlueNoroff, we had identified roughly 400 targets across 20 countries and observed the group relying heavily on social engineering tactics such as fake meetings, impersonation and AI-generated deepfakes to target founders, executives and investors across the Web3 community. Today, we've identified more than 677 targets across 58 countries.
“We've also seen the group's social engineering playbook expand well beyond fake meetings into document-sharing platforms, identity verification requests, media content and other trusted business workflows. While the tactics continue to evolve, the goal remains the same. They're exploiting trust to lower a target's guard and convince them to take an action that leads to compromise. That's what makes operations like this so effective and why efforts to disrupt them are so important,” Moore said.
Australian exposure
The figures indicate that Australian executives are part of a broad international target set rather than an isolated local campaign. Because the methods mimic familiar business processes, the risk extends beyond specialist crypto firms to investors and leaders whose roles bring them into contact with digital asset businesses or counterparties.
Trust is central to the campaign's design. By using invitations, verification checks and media files that resemble ordinary workplace exchanges, attackers seek to bypass scepticism and reduce the chance that a request appears unusual.
Artificial intelligence appears to have sharpened that approach rather than changed it entirely. The warning sign identified by Arctic Wolf remains simple: unsolicited requests to run a command or open a script.
“Any Australian founder, investor or crypto-exposed executive could receive a polished invite from a trusted contact. AI hasn't changed the trick. It has made the fake look real. Any request to run a command or open a script remains the warning sign,” Moore said.