Tuesday, April 29, 2025
HomeComputer SecurityNorth Korean HIDDEN COBRA Hackers Using New Attack Called "FASTCash" to Cash-out...

North Korean HIDDEN COBRA Hackers Using New Attack Called “FASTCash” to Cash-out From ATM Machine

Published on

SIEM as a Service

Follow Us on Google News

North Korean governments sponsored & worlds most famous hacking group HIDDEN COBRA using a new Attack called  “FASTCash” to cash out from the ATM Machine by compromising the bank server.

Attackers using a various mechanism to compromise and maintain the persistance in the victim’s network.

In this case, FBI & DHS issued a serious warning about this cyber attack and examines the tactics, techniques of FASTCash-Related Malware.

- Advertisement - Google News

APT attackers initiating this ATM based attack mainly targeting against Africa and Asia based banks and still investigating this incident to confirm whether it targets any other origins.

Previous similar incidents conducted by HIDDEN COBRA hackers have stolen tens of millions of dollars and they enabled cash to be simultaneously withdrawn from ATMs located in over 30 different countries.

Another incident in this year same threat actors enable the cashout and withdraw money from ATMs in 23 different countries.

FASTCash scheme refers that an attacker remotely compromises payment switch application servers within banks to facilitate fraudulent transactions also attackers focusing on retail payment systems that vulnerable to remote exploitation.

How Does This FASTCash campaign Works

Initially, HIDDEN COBRA attackers targeting Bank employees using Spear phishing campaign in order to compromise the bank network but an exact infection vector of this campaign is still unknown.

Mainly they are using Windows-based malware to explore a bank’s network that helps to identify the payment switch application server.

Later attackers using some legitimate credentials to move further in bank network and access the switch application server using a specific pattern.

Based on the US-CERT Statement,some of the files used by HIDDEN COBRA actors were legitimate, and not inherently malicious, it is likely that HIDDEN COBRA actors used these legitimate files for malicious purposes. See MAR-1021537 for details on the files used. Malware samples obtained for analysis included AIX executable files intended for a proprietary UNIX operating system developed by IBM.

Once the bank switch application server successfully compromised then the threat actors deploy the legitimate script on the payment switch application server using command-line utility applications in order to intercept and reply to financial request messages with fraudulent but legitimate-looking affirmative response messages.

FASTCash
                                                                  Anatomy of a FASTCash scheme

Also, the APT group has highly skilled experts who all are having extraordinary knowledge in International Standards Organization (ISO) 8583—the standard for financial transaction messaging to deployed ISO 8583 libraries on the targeted switch application servers.

This helps to interpret financial request messages and properly form a fraudulent financial response message.

Finally, the injected malicious script basically alter the expected behavior of the server by targeting the business process, rather than exploiting a technical process. US-CERT said.

In this case, “U.S. Government recommends that network administrators review MAR-10201537 for IOCs related to the HIDDEN COBRA FASTCash campaign, identify whether any of the provided IOCs fall within their organization’s network, and—if found—take necessary measures to remove the malware.”

Also Read:

ATMJackpot – New ATM Malware Steal Your Money From ATM using ATM Jackpotting Technique

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Blinded from Above: How Relentless Cyber-Attacks Are Knocking Satellites Out of Sight

According to the Center for Strategic & International Studies' (CSIS) 2025 Space Threat Assessment,...

Google Chrome Vulnerability Allows Attackers to Bypass Sandbox Restrictions – Technical Details Revealed

A severe vulnerability, identified as CVE-2025-2783, has been discovered in Google Chrome, specifically targeting...

Threat Actors Accelerate Transition from Reconnaissance to Compromise – New Report Finds

Cybercriminals are leveraging automation across the entire attack chain, drastically reducing the time from...

ResolverRAT Targets Healthcare and Pharmaceutical Sectors Through Sophisticated Phishing Attacks

A previously undocumented remote access trojan (RAT) named ResolverRAT has surfaced, specifically targeting healthcare...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

RansomHub Ransomware Deploys Malware to Breach Corporate Networks

The eSentire’s Threat Response Unit (TRU) in early March 2025, a sophisticated cyberattack leveraging...

Advanced Multi-Stage Carding Attack Hits Magento Site Using Fake GIFs and Reverse Proxy Malware

A multi-stage carding attack has been uncovered targeting a Magento eCommerce website running an...

Hannibal Stealer: Cracked Variant of Sharp and TX Malware Targets Browsers, Wallets, and FTP Clients

A new cyber threat, dubbed Hannibal Stealer, has surfaced as a rebranded and cracked...