CISA, the FBI, and the Department of Defense identified FASTCASH for Windows as malware used by the North Korean government under the U.S. HIDDEN COBRA designation. The malware is injected into banking processes, hooks Windows network APIs, and parses ISO 8583 messages associated with ATM and point-of-sale transactions. It can identify configured account numbers, alter authorization responses, and approve fraudulent withdrawals beyond available balances. The report analyzes three samples and provides cryptographic indicators and behavioral details for detection.