FASTCash

Executive Summary

FASTCash is a sophisticated cyber-enabled ATM cash-out campaign identified by the Treasury and FBI as linked to North Korean state-sponsored actors. This campaign has targeted banks in Africa and Asia since late 2016, compromising payment switch application servers to steal tens of millions of dollars through fraudulent transactions.

Goals & Targeting

FASTCash's primary goal appears to be the theft of significant financial resources through fraudulent transactions, with a focus on targeting banking systems in Africa and Asia. The campaign exploits vulnerabilities in payment switch servers, enabling unauthorized access and manipulation of ATM networks. The choice of sectors and regions likely reflects opportunities for high-value targets with weaker cybersecurity defenses. Victims have included banks and financial institutions vulnerable to remote exploitation, making them attractive for large-scale fraud.

FASTCash represents a significant cyber threat to financial institutions, particularly those operating in regions with inadequate cybersecurity measures. The campaign leverages advanced techniques to compromise payment systems, enabling the theft of large sums via ATM networks. It is notable for its state-sponsored origins, with the FBI attributing the malware used in these attacks to North Korea. FASTCash demonstrates a high level of technical sophistication, with operators targeting vulnerable retail payment systems and exploiting remote access capabilities to execute their attacks. The long operational timeframe (since late 2016) and continued activity suggest a well-resourced and persistent threat actor focused on financial gain.

Key Capabilities

• Remote compromise of payment switch application servers
• Execution of fraudulent transactions through compromised systems
• Persistence in target networks for prolonged periods
• Use of malware linked to North Korean state-sponsored actors
• Targeting vulnerable retail payment systems

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

FASTCash has demonstrated a persistent and evolving approach to targeting financial systems. The campaign's longevity since late 2016 indicates a well-planned operational strategy, with operators likely refining their techniques over time. Targeting of banks in Africa and Asia suggests an understanding of regional cybersecurity gaps. Notable operations include high-profile ATM cash-outs, which indicate both technical proficiency and an ability to exploit systemic vulnerabilities in payment infrastructure.

IOC Patterns

• Unusual spikes in ATM transaction volumes
• Network traffic anomalies within payment systems
• Presence of custom malware linked to North Korean APT groups

Recommended Actions

• Implement robust security measures for retail payment systems and ATM networks
• Monitor for unusual patterns in financial transaction logs
• Conduct regular penetration testing on payment switch servers
• Adopt MITRE ATT&CK-based detection mechanisms to identify potential compromises
• Enhance network segmentation to limit lateral movement by attackers

Suggested Tags