HIDDEN COBRA is the designation the United States government uses for malicious cyber activity conducted by the North Korean government, which commercial security reporting has also linked to the Lazarus Group. According to a 2017 joint technical alert from the Department of Homeland Security and FBI, the actor has operated since at least 2009, targeting media, aerospace, financial, and critical-infrastructure organizations in the United States and globally, and using tools including DDoS botnets, keyloggers, remote access trojans, and destructive wiper malware. A separate joint alert from DHS, the FBI, and the Treasury Department detailed a financially motivated operation the government named FASTCash, active since at least late 2016, in which the actors compromised bank payment-switch application servers, often running outdated and unsupported software, and used their understanding of international financial messaging standards to inject fraudulent but legitimate-looking approval messages. This enabled simultaneous fraudulent cash withdrawals from ATMs in dozens of countries in single incidents during 2017 and 2018, netting the actors tens of millions of dollars from targeted banks in Africa and Asia.