An alert was released about a new ATM cash out scheme called FASTCash, being used by Lazarus group.
PUBLISH DATE: 10-08-2018
Hidden Cobra, also known as Lazarus Group and Guardians of Peace, is believed to be backed by the North Korean government. They’re using a technique called “FASTCash” since 2016 to cash out ATMs by compromising the bank server.
The WannaCry Ransomware menace of 2017, the SWIFT banking attacks of 2016 and the Sony Pictures hack of 2014 are all associated with the same hacking group, Hidden Cobra or Lazarus group, backed by North Korean government. They are said to have stolen tens of millions of dollars, simultaneously attacking ATMs in over 30 countries in 2017 and in 23 countries in 2018.
FASTCash cyber-attacks involve the usage of ten different malwares that have yet been discovered. The researchers believe that attackers remotely compromise payment “switch application servers” within the targeted banks to facilitate unauthorized transactions.
Being an essential component of ATMs and Point-of-Sale infrastructures, Switch application server communicates with the core banking system to validate user’s bank account details for a requested transaction.
When your ATM card is used in an ATM or PoS machine, the software communicates with the bank’s switch application server to validate the transaction, and then accept or decline based on bank balance.
The malware installed on the compromised switch application servers then intercepts transaction request associated with the attackers’ payment cards and responds with fake but legitimate-looking affirmative response without actually validating their available balance with the core banking systems. Eventually ATMs are fooled into spitting out large amounts of cash without sending a notification to the bank.
The common thing in all the compromised switch application servers is that they were running unsupported IBM Advanced Interactive eXecutive (AIX) operating system versions beyond the end of their service pack support dates. However, there’s no evidence that those have been exploited. The initial attack vector is also unknown.
Windows-based malwares seem to be the vectors to explore a bank’s network to identify the payment switch application server. However, each incident occurred with the usage of a different malware, samples indicate similarities in malware capabilities and functionalities.
Also, it looks like legitimate credentials were used to move laterally through a bank’s network to illicitly access the switch application server. Threat actors likely deployed legitimate scripts—using command-line utility applications on the payment switch application server.
INDICATORS OF COMPROMISE
US-CERT recommends that organizations filter their systems for these files, containing Backdoors, Trojans, Executables and scripts and block them if there are any indicators of compromise running in the system.
Mitigation Recommendations for Institutions with Retail Payment Systems
Recommendations for Organizations with ATM or Point-of-Sale Devices
If you think you are a victim of a cyber-security attack. Immediately send an email to firstname.lastname@example.org for a rapid response.