FASTCash schemes remotely compromise payment switch application servers within banks to facilitate fraudulent transactions. APT group Lazarus has been targeting this FASTCash schemes previously as well for their financial gains and targeting different banking sectors around the world. FASTCash compromises financial institution networks and engages in fraudulent ATM withdrawals both domestically and across international borders, as well as fraudulent interbank transfers.
The newly identified file is a dynamic link library (DLL) backdoor likely used by the threat actors to obtain remote access to a targeted machine.
|Block all threat indicators at your respective controls.|
Check for IOCs in your environment.