FASTCash

lazarus.day

FASTCash was a DPRK-attributed banking campaign in which HIDDEN COBRA/Lazarus-linked operators compromised payment-switch infrastructure to authorize fraudulent ATM withdrawals by manipulating ISO 8583 transaction responses. Reports describe AIX and later Linux/Windows payment-switch malware injected into switch processes, use of stolen credentials and lateral movement inside bank networks, and activity affecting banks across Africa, Asia, and other countries from at least 2016 through later variants.

CSIS Significant Cyber Incidents

North Korean hackers were found to have used malware to steal tens of millions of dollars from ATMs across Asia and Africa

EuRepoC

The North Korean state-sponsored hacking group Lazarus (aka APT38/HIDDEN COBRA) targeted African and Asian banks in an ATM cash-out scheme since 2016 that was dubbed "FASTCash" by the US authorities. The related CISA report states the following regarding the impact of the campaign: "According to a trusted partner’s estimation, HIDDEN COBRA actors have stolen tens of millions of dollars. In one incident in 2017, HIDDEN COBRA actors enabled cash to be simultaneously withdrawn from ATMs located in over 30 different countries. In another incident in 2018, HIDDEN COBRA actors enabled cash to be simultaneously withdrawn from ATMs in 23 different countries.”

CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA)

A joint technical alert from the DHS, the FBI, and the Treasury warns about a new ATM cash-out scheme, dubbed "FASTCash," used by the Hidden Cobra APT.

Mendeley Data: Collection of DPRK state-sponsored threat actors' activities v2 (Lyu, Sungkyunkwan Univ.)

Reported: 2018-10; Victims: FASTCash; Motivations: FinancialGain; Sectors: Finance; Countries: Worldwide

CISA/State/Treasury/FBI advisory AA20-106A "Guidance on the North Korean Cyber Threat" (list: Cyber Operations Publicly Attributed to DPRK by U.S. Government)

FASTCash Campaign. Since late 2016, DPRK state-sponsored cyber actors have employed a fraudulent ATM cash withdrawal scheme known as “FASTCash” to steal tens of millions of dollars from ATMs in Asia and Africa. FASTCash schemes remotely compromise payment switch application servers within banks to facilitate fraudulent transactions. In one incident in 2017, DPRK cyber actors enabled the withdrawal of cash simultaneously from ATMs located in more than 30 different countries. In another incident in 2018, DPRK cyber actors enabled cash to be simultaneously withdrawn from ATMs in 23 different countries. CISA’s Alert on FASTCash Campaign (Oct. 2, 2018) https://www.us-cert.gov/ncas/alerts/TA18-275A CISA’s Malware Analysis Report: FASTCash-Related Malware (Oct. 2, 2018) https://www.us-cert.gov/ncas/analysis-reports/AR18-275A

CISA/DHS/Treasury/FBI alert TA18-275A (HIDDEN COBRA – FASTCash Campaign)

Since at least late 2016, HIDDEN COBRA actors have used FASTCash tactics to target banks in Africa and Asia.

CISA/DHS/Treasury/FBI alert TA18-275A (HIDDEN COBRA – FASTCash Campaign)

According to a trusted partner's estimation, HIDDEN COBRA actors have stolen tens of millions of dollars.

CISA/DHS/Treasury/FBI alert TA18-275A (HIDDEN COBRA – FASTCash Campaign)

In one incident in 2017, HIDDEN COBRA actors enabled cash to be simultaneously withdrawn from ATMs located in over 30 different countries.

CISA/Treasury/FBI/USCYBERCOM advisory AA20-239A (FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks)

The BeagleBoyz initially targeted switch applications at individual banks with FASTCash malware but, more recently, have targeted at least two regional interbank payment processors.

Hackmageddon cyber attacks timelines (Paolo Passeri)

A joint technical alert from the DHS, the FBI, and the Treasury warns about a new ATM cash-out scheme, dubbed “FASTCash,” used by the Hidden Cobra APT.

According to a trusted partner's estimation, HIDDEN COBRA actors have stolen tens of millions of dollars.