FastCash 2.0

#FastCash2 • 2020-10

🇦🇷 Argentina, 🇧🇷 Brazil, 🇧🇩 Bangladesh, 🇧🇦 Bosnia and Herzegovina, 🇧🇬 Bulgaria, 🇨🇱 Chile, 🇨🇷 Costa Rica, 🇪🇨 Ecuador, 🇬🇭 Ghana, 🇮🇳 India, 🇮🇩 Indonesia, 🇯🇵 Japan, 🇯🇴 Jordan, 🇰🇪 Kenya, 🇰🇼 Kuwait, 🇲🇾 Malaysia, 🇲🇹 Malta, 🇲🇽 Mexico, 🇲🇿 Mozambique, 🇳🇵 Nepal, 🇳🇮 Nicaragua, 🇳🇬 Nigeria, 🇵🇰 Pakistan, 🇵🇦 Panama, 🇵🇪 Peru, 🇵🇭 Philippines, 🇸🇬 Singapore, 🇿🇦 South Africa, 🇰🇷 Korea, Republic of, 🇪🇸 Spain, 🇹🇼 Taiwan, 🇹🇿 Tanzania, United Republic of, 🇹🇬 Togo, 🇹🇷 Türkiye, 🇺🇬 Uganda, 🇺🇾 Uruguay, 🇻🇳 Viet Nam, 🇿🇲 Zambia

CISA, Treasury, FBI, and USCYBERCOM attributed FASTCash 2.0 ATM cash-out activity to North Korea's BeagleBoyz, a HIDDEN COBRA subset overlapping with Lazarus, APT38, Bluenoroff, and Stardust Chollima. The campaign targeted financial institutions and payment switch infrastructure, expanding from Unix-like switch servers to Windows-hosted switch applications and interbank payment processors while using spear-phishing, watering holes, public-facing exploitation, credential theft, lateral movement, destructive anti-forensics, proxy tunneling, and FASTCash-related malware.

Related Actors

Beagle Boyz

USCISA

The U.S. government tracks BeagleBoyz as a North Korean hacking team, an element of the Reconnaissance General Bureau, that overlaps to varying degrees with groups tracked elsewhere as Lazarus, APT38, Bluenoroff, and Stardust Chollima, and represents a subset of the broader Hidden Cobra activity. Likely active since at least 2014, BeagleBoyz conducts well-planned, disciplined bank robberies rather than typical cybercrime, and has attempted to steal nearly two billion dollars since 2015 through fraudulent ATM cash-out schemes and abuse of compromised bank SWIFT terminals, including the 2016 theft of eighty-one million dollars from Bangladesh Bank. The group has targeted financial institutions across dozens of countries in Africa, Asia, Europe, and the Americas, gaining initial access through spearphishing, watering holes, exploitation of internet-facing applications, and stolen credentials, sometimes obtaining footholds through third-party criminal groups. BeagleBoyz has also deployed destructive wiper and anti-forensic tools against victim banks to disrupt operations and conceal fraudulent transactions, generating revenue believed to fund North Korea's weapons programs.

FASTCash 2.0: North Korea's BeagleBoyz Robbing Ba…
Associated with: Bluenoroff
First seen: 2020-08 • Last seen: 2021-03

Related Reports

« Back