Saturday, June 22, 2024

Researchers Uncover How Lazarus Hacking Group Stole Millions of Dollars From ATMs

Lazarus Hacking Group is known for launching highly Sophisticated Cyber attacks targeting various sectors such as entertainment, financial services, defense, technology, and virtual currency industries, academia, and electric utilities.

Their activities including the development of various malware that was used for one of the biggest Wannacry Ransomware attacks in 2017, Sony cyber Attack on 2014 and Bangladesh Bank attack where attackers theft $81 million.

Security researchers from Symantec uncover the important tool used by Lazarus Hacking Group to steal money from the ATMs.

According to Symantec’s research, to make the fraudulent withdrawals, Lazarus first breaches targeted banks’ networks and compromises the switch application servers handling ATM transactions.

Once the server compromised they deploy previously unknown malware (Trojan.Fastcash) which intercepts the fraudulent withdrawal requests and send fake responses to dispense cash from ATMs.

Lazarus Hacking Group
Credits: Symantec

ISO 8583 is standard message format that details the exchange between the credit/debit card issuers and the devices where it used such as point-of-sale devices and automated teller machines.

Attackers inject malicious codes into a legitimate process on application servers running the AIX operating system, the inserted malicious script has the ability to construct the ISO 8583 messages.

According to Symantec analysis, the malware monitors incoming messages and intercepts the attacker generated fraudulent transaction requests to prevent them from reaching the switch application.

Then it transmits a fake response approving fraudulent withdrawal requests and the hacker group drops cash from the ATM.

“Symantec has found several different variants of (Trojan.Fastcash), each of which uses different response logic. The attackers appear to have built in a capability to selectively deny transactions based on their own blacklist of account numbers.”

Website

Latest articles

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from Promokit.eu for...

Beware Of Illegal OTT Platforms That Exposes Sensitive Personal Information

A recent rise in data breaches from illegal Chinese OTT platforms exposes that user...

Beware Of Zergeca Botnet with Advanced Scanning & Persistence Features

A new botnet named Zergeca has emerged, showcasing advanced capabilities that set it apart...

Mailcow Mail Server Vulnerability Let Attackers Execute Remote Code

Two critical vulnerabilities (CVE-2024-31204 and CVE-2024-30270) affecting Mailcow versions before 2024-04 allow attackers to...

Hackers Attacking Vaults, Buckets, And Secrets To Steal Data

Hackers target vaults, buckets, and secrets to access some of the most classified and...

Hackers Weaponizing Windows Shortcut Files for Phishing

LNK files, a shortcut file type in Windows OS, provide easy access to programs,...

New Highly Evasive SquidLoader Attacking Employees Mimic As Word Document

Researchers discovered a new malware loader named SquidLoader targeting Chinese organizations, which arrives as...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles