CISA analyzed HIDDEN COBRA malware used in the DPRK-linked FASTCash operation to facilitate fraudulent ATM withdrawals. Malicious XCOFF components injected into legitimate processes on IBM AIX financial systems and modified ISO 8583 transaction messages. Supporting Windows malware provided proxy, remote-command, file-transfer, payload-installation, and data-exfiltration capabilities while modifying firewall settings. One remote-access Trojan contained the hard-coded command-and-control address 75.99.63.27 and listened on TCP port 443.