Resumed bank targeting: fraudulent international money transfers and ATM cash outs

lazarus.day

CISA, Treasury, FBI, and USCYBERCOM attributed FASTCash 2.0 ATM cash-out activity to North Korea's BeagleBoyz, a HIDDEN COBRA subset overlapping with Lazarus, APT38, Bluenoroff, and Stardust Chollima. The campaign targeted financial institutions and payment switch infrastructure, expanding from Unix-like switch servers to Windows-hosted switch applications and interbank payment processors while using spear-phishing, watering holes, public-facing exploitation, credential theft, lateral movement, destructive anti-forensics, proxy tunneling, and FASTCash-related malware.

CSIS Significant Cyber Incidents

U.S. officials announced that North Korean government hackers had been operating a campaign focused on stealing money from ATMs around the world.

CFR Cyber Operations Tracker

Hackers affiliated with the Lazarus Group targeted automated teller machines (ATMs) by manipulating transaction-processing software to initiate fraudulent cash-outs.

Mendeley Data: Collection of DPRK state-sponsored threat actors' activities v2 (Lyu, Sungkyunkwan Univ.)

Reported: 2020-10; Victims: FastCash 2.0; Motivations: FinancialGain; Sectors: Finance; Countries: Argentina, Brazil, Bangladesh, Bosnia and Herzegovina, Bulgaria, Chile, Costa Rica, Ecuador, Ghana, India, Indonesia, Japan, Jordan, Kenya, Kuwait, Malaysia, Malta, Mexico, Mozambique, Nepal, Nicaragua, Nigeria, Pakistan, Panama, Peru, Philippines, Singapore, South Africa, Korea, Republic of, Spain, Taiwan, Tanzania, United Republic of, Togo, Turkey, Uganda, Uruguay, Viet Nam, Zambia

CISA/Treasury/FBI/USCYBERCOM advisory AA20-239A (FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks)

Since February 2020, North Korea has resumed targeting banks in multiple countries to initiate fraudulent international money transfers and ATM cash outs.

Fortinet FortiGuard Labs blog

CISA released a Joint Technical Alert attributing malicious cyber activity to the North Korean government. FortiGuard Labs provides a brief breakdown of the Joint Technical Alert and Malware Analys…

The BeagleBoyz have attempted to steal nearly $2 billion since at least 2015, according to public estimates.