What is FASTCash Malware?

North Korean threat actors are once again targeting financial institutions, this time employing a Linux variant of the notorious FASTCash malware. This latest development underscores the evolving tactics of cybercriminals and the increasing vulnerability of Linux systems in critical infrastructure.

The FASTCash malware has been a thorn in the side of financial institutions since at least 2016. Initially documented by the U.S. government in 2018, the malware was linked to North Korean adversaries and was known to facilitate ATM cashouts targeting banks in Africa and Asia.

This latest discovery, however, reveals a significant shift in the threat landscape. The newly discovered Linux variant, aptly named "libMyFc.so," is specifically designed to infiltrate Ubuntu Linux 20.04 systems. This adaptation is a clear indication that North Korean actors are actively expanding their targeting scope and developing new capabilities to exploit previously overlooked vulnerabilities.

The "libMyFc.so" malware works by intercepting and manipulating ISO 8583 transaction messages, the language of credit and debit card processing. This allows the attackers to authorize fraudulent fund withdrawals, effectively bypassing the normal security protocols. The malware achieves this by manipulating declined transactions - those flagged due to insufficient funds - for specific cardholder account numbers. The malware then approves these transactions, authorizing a predetermined amount of funds to be withdrawn in Turkish Lira.

The amounts withdrawn through these illicit transactions range from 12,000 to 30,000 Lira ($350 to $875), aligning with previous observations of the Windows-based FASTCash variant. The similarity in the tactics and the monetary amounts targeted suggests a clear connection between the two, implying that the North Korean actors are using their expertise with the Windows variant to develop and deploy Linux-specific versions.

This discovery highlights a critical concern: the increasing vulnerability of Linux systems in financial institutions. While traditionally considered more secure than Windows environments, the rapid proliferation of Linux servers in critical infrastructure has attracted the attention of cybercriminals. This move to Linux environments by the North Korean threat actors is a testament to their evolving strategies and their willingness to exploit previously less explored avenues.

The discovery of this Linux variant underscores the importance of proactive security measures, particularly within Linux server environments. Financial institutions need to prioritize comprehensive security strategies that encompass both Windows and Linux systems, ensuring that they have adequate detection capabilities to identify and mitigate these threats.

This incident serves as a stark reminder that the threat landscape is constantly shifting, and cybercriminals are constantly adapting their tactics. Financial institutions must remain vigilant, investing in advanced security measures and staying informed about the latest threats to ensure the protection of their systems and the financial security of their customers.