North Korean FaceStealer Campaign Disrupted: Defending Against $400M Cryptocurrency Social Engineering Operation

---
title: Suspicious Access to Cryptocurrency Wallet Files
id: 8f4e2a91-3b7c-4d1e-9a5f-2c6d8e1b4a7f
status: experimental
description: Detects suspicious processes accessing cryptocurrency wallet files and browser extension storage commonly targeted by FaceStealer and similar campaigns.
references:
  - https://attack.mitre.org/techniques/T1552/001/
  - https://attack.mitre.org/techniques/T1555/003/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.t1555.003
logsource:
  category: file_event
  product: windows
detection:
  selection_wallet_paths:
    TargetFilename|contains:
      - '\AppData\Roaming\Bitcoin\wallet.dat'
      - '\AppData\Roaming\Ethereum\keystore\'
      - '\AppData\Roaming\Exodus\'
      - '\AppData\Roaming\Electrum\wallets\'
      - '\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn'  # MetaMask
      - '\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm'  # MetaMask Flask
  filter_legitimate:
    Image|endswith:
      - '\Bitcoin\bitcoin-qt.exe'
      - '\Ethereum\geth.exe'
      - '\Exodus\exodus.exe'
      - '\electrum.exe'
      - '\chrome.exe'
      - '\msedge.exe'
  condition: selection_wallet_paths and not filter_legitimate
falsepositives:
  - Legitimate wallet applications and browsers accessing their own data
  - Portfolio tracking software
level: high
---
title: Credential Dumping via LSASS Memory Access
id: 3c9f7b42-8e1d-4a6f-b2c9-5d7e8f1a3b6c
status: experimental
description: Detects suspicious processes accessing LSASS memory, a technique used by FaceStealer malware to extract authentication credentials.
references:
  - https://attack.mitre.org/techniques/T1003/001/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1410'
      - '0x1438'
      - '0x143a'
      - '0x1FFFFF'
  filter_legitimate:
    SourceImage|endswith:
      - '\Windows\System32\svchost.exe'
      - '\Windows\System32\wininit.exe'
      - '\Windows\System32\services.exe'
      - '\Program Files\'
      - '\Program Files (x86)\'
      - '\Windows\System32\MsMpEng.exe'
  condition: selection and not filter_legitimate
falsepositives:
  - Legitimate security tools and EDR agents
  - System management tools
level: high
---
title: Suspicious npm Package Installation from Non-Standard Directories
id: 6d2e8f4a-9c3b-4e7f-a1d6-8b5c2e9f4a7d
status: experimental
description: Detects npm package installations executed from temporary or user directories, a common delivery mechanism for malicious packages in supply chain and social engineering attacks.
references:
  - https://attack.mitre.org/techniques/T1195/
  - https://attack.mitre.org/techniques/T1059/006/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1195
  - attack.t1059.006
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\npm.exe'
      - '\node.exe'
    CommandLine|contains:
      - 'install'
      - 'i '
    ParentImage|endswith:
      - '\explorer.exe'
      - '\cmd.exe'
      - '\powershell.exe'
  selection_suspicious_paths:
    CommandLine|contains:
      - '\AppData\Local\Temp\'
      - '\Downloads\'
      - '\Desktop\'
      - 'C:\Users\Public\'
  condition: selection and selection_suspicious_paths
falsepositives:
  - Developers installing packages from project directories
  - Legitimate development workflows
level: medium

// Hunt for suspicious access to cryptocurrency wallet files and browser credential stores
// Targets FaceStealer and similar cryptocurrency theft campaigns
let WalletPaths = dynamic([
    @"\AppData\Roaming\Bitcoin\wallet.dat",
    @"\AppData\Roaming\Ethereum\keystore",
    @"\AppData\Roaming\Exodus",
    @"\AppData\Roaming\Electrum\wallets",
    @"nkbihfbeogaeaoehlefnkodbefgpgknn",  // MetaMask extension ID
    @"ejbalbakoplchlghecdalmeeeajnimhm"   // MetaMask Flask
]);
let LegitimateWalletApps = dynamic([
    @"bitcoin-qt.exe", @"geth.exe", @"exodus.exe", @"electrum.exe",
    @"chrome.exe", @"msedge.exe", @"firefox.exe"
]);
union isfuzzy=true
    (DeviceFileEvents
    | where TimeGenerated > ago(7d)
    | where FolderPath has_any (WalletPaths)
    | where not(FileName in~ (LegitimateWalletApps))
    | where not(InitiatingProcessFileName in~ (LegitimateWalletApps))
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
              FolderPath, FileName, SHA256, InitiatingProcessAccountName
    | extend DetectionType = "Wallet File Access"),
    (DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where ProcessCommandLine has_any (@"lsass", @"sekurlsa", @"mimikatz")
    | where not(FileName in~ (@"MsMpEng.exe", @"svchost.exe", @"wininit.exe"))
    | where not(FolderPath startswith @"C:\Program Files")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine,
              FolderPath, SHA256, AccountName
    | extend DetectionType = "Credential Dumping Attempt")
| sort by TimeGenerated desc
| summarize arg_max(TimeGenerated, *) by DeviceName, DetectionType

-- FaceStealer Campaign Detection Artifact
-- Hunts for cryptocurrency wallet access and credential theft indicators

LET wallet_processes = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(bitcoin|ethereum|exodus|electrum|metamask|wallet\\.dat|keystore)'
  AND NOT Exe =~ '(bitcoin-qt|geth|exodus|electrum|chrome|firefox|msedge)\\.exe$'

LET suspicious_lsass_access = SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE CommandLine =~ '(lsass|sekurlsa|mimikatz|procdump.*lsass)'
  AND NOT Exe =~ '(MsMpEng|svchost|wininit|csrss)\\.exe$'

LET wallet_files = SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=[
    'C:/Users/*/AppData/Roaming/Bitcoin/wallet.dat',
    'C:/Users/*/AppData/Roaming/Ethereum/keystore/*',
    'C:/Users/*/AppData/Roaming/Exodus/**',
    'C:/Users/*/AppData/Roaming/Electrum/wallets/*'
])
WHERE Mtime > now() - (7 * 24 * 60 * 60)  // Files accessed in last 7 days

SELECT 'Suspicious Wallet Process' AS DetectionType, Pid, Name, CommandLine, Username, CreateTime AS Timestamp
FROM wallet_processes
UNION ALL
SELECT 'Credential Dumping Tool' AS DetectionType, Pid, Name, CommandLine, Username, NULL AS Timestamp
FROM suspicious_lsass_access
UNION ALL
SELECT 'Recent Wallet File Activity' AS DetectionType, NULL AS Pid, FullPath AS Name, 
       format(format='Size: %d bytes', args=[Size]) AS CommandLine, NULL AS Username, Mtime AS Timestamp
FROM wallet_files

#Requires -RunAsAdministrator
# FaceStealer Campaign - Endpoint Hardening Script
# Implements controls to prevent cryptocurrency theft and credential dumping

Write-Host "[+] FaceStealer Threat Mitigation Script" -ForegroundColor Cyan
Write-Host "[+] Implementing endpoint hardening controls..." -ForegroundColor Cyan

# 1. Enable Windows Defender Credential Guard (requires reboot)
Write-Host "`n[1] Enabling Windows Defender Credential Guard..." -ForegroundColor Yellow
$CGPath = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard"
if (!(Test-Path $CGPath)) { New-Item -Path $CGPath -Force | Out-Null }
Set-ItemProperty -Path $CGPath -Name "EnableVirtualizationBasedSecurity" -Value 1
Set-ItemProperty -Path "$CGPath\Scenarios\CredentialGuard" -Name "Enabled" -Value 1 -ErrorAction SilentlyContinue
Write-Host "    Credential Guard configured (reboot required)" -ForegroundColor Green

# 2. Enable LSASS Protection (RunAsPPL)
Write-Host "`n[2] Enabling LSASS Protection (RunAsPPL)..." -ForegroundColor Yellow
$LSAPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"
Set-ItemProperty -Path $LSAPath -Name "RunAsPPL" -Value 1 -ErrorAction SilentlyContinue
Write-Host "    LSASS protection enabled (reboot required)" -ForegroundColor Green

# 3. Block suspicious processes from accessing wallet directories via Windows Defender Attack Surface Reduction
Write-Host "`n[3] Configuring Attack Surface Reduction rules..." -ForegroundColor Yellow
$ASRRules = @{
    "Block credential stealing from LSASS" = "9e6c4e1f-7d60-472f-b1ba-a39c669d1a9b"
    "Block process creations from PSExec and WMI" = "d1e49aac-8f56-4280-b9ba-993a6d77406c"
    "Block untrusted processes from USB" = "b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4"
}
foreach ($RuleName in $ASRRules.Keys) {
    $RuleGUID = $ASRRules[$RuleName]
    Add-MpPreference -AttackSurfaceReductionRules_Ids $RuleGUID -AttackSurfaceReductionRules_Actions Enabled
    Write-Host "    Enabled: $RuleName" -ForegroundColor Green
}

# 4. Create controlled folder access rules for wallet directories
Write-Host "`n[4] Configuring Controlled Folder Access for wallet paths..." -ForegroundColor Yellow
$WalletPaths = @(
    "$env:APPDATA\Bitcoin",
    "$env:APPDATA\Ethereum",
    "$env:APPDATA\Exodus",
    "$env:APPDATA\Electrum"
)
foreach ($Path in $WalletPaths) {
    if (Test-Path $Path) {
        Add-MpPreference -ControlledFolderAccessProtectedFolders $Path
        Write-Host "    Protected: $Path" -ForegroundColor Green
    }
}
Set-MpPreference -EnableControlledFolderAccess Enabled

# 5. Audit for suspicious npm/python packages installed outside Program Files
Write-Host "`n[5] Auditing for suspicious package installations..." -ForegroundColor Yellow
$SuspiciousPaths = @("$env:TEMP", "$env:USERPROFILE\Downloads", "$env:USERPROFILE\Desktop", "C:\Users\Public")
$SuspiciousPackages = Get-ChildItem -Path $SuspiciousPaths -Recurse -Include "package.json","setup.py","requirements.txt" -ErrorAction SilentlyContinue | 
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) }
if ($SuspiciousPackages) {
    Write-Host "    WARNING: Found $($SuspiciousPackages.Count) recently modified package files in user directories:" -ForegroundColor Red
    $SuspiciousPackages | ForEach-Object { Write-Host "      - $($_.FullName)" -ForegroundColor Red }
    Write-Host "    Review these for potential malicious packages" -ForegroundColor Yellow
} else {
    Write-Host "    No suspicious packages found" -ForegroundColor Green
}

# 6. Check for suspicious browser extensions (cryptocurrency wallet extensions should be verified)
Write-Host "`n[6] Auditing browser extensions..." -ForegroundColor Yellow
$ChromeExtPath = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions"
if (Test-Path $ChromeExtPath) {
    $Extensions = Get-ChildItem $ChromeExtPath -Directory
    Write-Host "    Found $($Extensions.Count) Chrome extensions. Manually verify cryptocurrency wallet extensions." -ForegroundColor Yellow
    Write-Host "    Legitimate MetaMask ID: nkbihfbeogaeaoehlefnkodbefgpgknn" -ForegroundColor Cyan
}

# 7. Enable PowerShell Script Block Logging for better detection
Write-Host "`n[7] Enabling PowerShell Script Block Logging..." -ForegroundColor Yellow
$PSLogPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
if (!(Test-Path $PSLogPath)) { New-Item -Path $PSLogPath -Force | Out-Null }
Set-ItemProperty -Path $PSLogPath -Name "EnableScriptBlockLogging" -Value 1
Write-Host "    Script Block Logging enabled" -ForegroundColor Green

# 8. Summary and recommendations
Write-Host "`n[+] Hardening Complete" -ForegroundColor Green
Write-Host "`n[IMPORTANT] Next Steps:" -ForegroundColor Cyan
Write-Host "  1. Reboot the system to activate Credential Guard and LSASS Protection" -ForegroundColor White
Write-Host "  2. Review any suspicious packages identified in step 5" -ForegroundColor White
Write-Host "  3. Educate users about social engineering risks (fake job offers, malicious interviews)" -ForegroundColor White
Write-Host "  4. Consider hardware wallets for cryptocurrency storage" -ForegroundColor White
Write-Host "  5. Implement application whitelisting (AppLocker/WDAC) for high-risk users" -ForegroundColor White
Write-Host "  6. Deploy network segmentation to isolate cryptocurrency operations" -ForegroundColor White