Symantec researchers dissect North Korean malware used in ATM attacks

The Lazarus Group's hacking scheme has triggered simultaneous withdrawals from ATMs in 23 countries this year alone.

As the North Korean government has felt the bite of international sanctions, its hackers have reportedly carried out damaging raids on financial institutions to raise cash. Few operations capture that naked ambition more clearly than a scheme that has reportedly stolen tens of millions of dollars from ATMs in Africa and Asia.

On Thursday, researchers from cybersecurity company Symantec detailed how the malware used in the ATM scheme intercepts fraudulent withdrawal requests and sends messages approving those withdrawals. The Lazarus Group, a broad set of North Korean hackers, is responsible for the so-called FastCash operation, according to Symantec.

“FASTCash illustrates that Lazarus possesses an in-depth knowledge of banking systems and transaction processing protocols and has the expertise to leverage that knowledge in order to steal large sums from vulnerable banks,” Symantec researchers wrote in a blog post.

The scheme has triggered simultaneous withdrawals from ATMs in 23 countries this year alone, according to a U.S. government advisory issued last month. “The U.S. government assesses that [North Korean government] actors will continue to use FASTCash tactics to target retail payment systems vulnerable to remote exploitation,” the notice says. There have not been any reports of FASTCash incidents involving institutions in the United States.

The malware used, which Symantec labeled Trojan.Fastcash, will help determine how successful the scheme continues to be. The malicious code targets the switch application servers that underpin ATM transactions, using an executable to produce fraudulent messages that appear to adhere to an industry standard, Symantec researchers said.

Symantec also found multiple versions of the malware, each of which used “different response logic.” It is unclear why those variations were used, but the researchers said they could be tailored to attacking different banks.

In all of the documented attacks, Lazarus hackers have breached banking application servers running outdated versions of an operating system, according to Symantec. “Lazarus continues to pose a serious threat to the banking sector and organizations should take all necessary steps to ensure that their payment systems are fully secured,” the blog states.

While the U.S. government has blamed North Korea for a string of cyberattacks, from the 2014 Sony Pictures Entertainment attack to the 2017 WannaCry incident, Pyongyang’s computer operatives have been undeterred. In a private advisory to industry last month obtained by CyberScoop, the FBI conceded as much.

North Korean hackers’ targeting of financial institutions worldwide “will continue unabated, regardless of the U.S. government public attribution of North Korea,” the FBI notice says.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure