Hidden Cobra FASTCash malware targets ATM financial networks
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CISA analysis of malware linked to Hidden Cobra that hijacks ATM transactions on Windows and AIX systems via ISO 8583 protocol manipulation.
This CISA Malware Analysis Report (MAR-10201537) documents a toolset attributed to Hidden Cobra targeting ATM and banking infrastructure. The attack toolkit comprises multiple components: Windows-based proxy trojans packaged with Themida, a RAT with firewall modification capability, and AIX/Unix executables specifically designed to intercept and manipulate ISO 8583 financial transaction protocols used for ATM card transactions. Two XCOFF executables previously marked non-malicious have been reclassified as actively malicious after further analysis showed they can inject into legitimate processes and modify ATM transaction data to generate fraudulent withdrawals. The toolkit also includes code-injection utilities for Unix systems and libraries that intercept ATM queries to banking backends, generating false responses with random cash amounts while blocking certain transactions. Hard-coded command and control infrastructure points to 75.99.63.27 on port 443. The malware uses RC4 encryption for C2 communications and registry-based persistence on Windows systems. No evidence of widespread exploitation is documented, but the sophistication and targeting of financial infrastructure indicates serious intent against banking sector targets.
Mentioned in this report
Detection guidance
Firewall AuthorizedApplications Registry Modified by Non-System Process
Detects a process writing to the Windows firewall AuthorizedApplications list in the registry, a way a RAT can allow itself through the firewall. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Firewall AuthorizedApplications Registry Modified by Non-System Process
description: Detects registry writes to the Windows firewall AuthorizedApplications
list by processes other than the firewall service host. Malware such as the Hidden
Cobra RAT can use this to add firewall exceptions for itself.
tags:
- attack.defense-impairment
- attack.t1112
- attack.t1686
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
filter_svchost:
Image|endswith: \svchost.exe
condition: selection and not filter_svchost
falsepositives:
- Legacy installers that register themselves in the firewall exception list via the
registry
level: medium
id: f8059391-4ba6-5f79-9cc0-32d353b21d82
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar18-275a
Run Key Persistence Pointing to User-Writable Path
Detects a Run registry value set to a binary in a user-writable location such as ProgramData, Public, AppData or Temp, consistent with registry-based persistence by the Hidden Cobra Windows implants. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Run Key Persistence Pointing to User-Writable Path
description: Detects creation of a CurrentVersion Run value whose data points to ProgramData,
Users\Public, Temp or AppData, a common registry persistence pattern for Windows
implants such as those in the Hidden Cobra toolkit.
tags:
- attack.persistence
- attack.t1112
- attack.t1547.001
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \Microsoft\Windows\CurrentVersion\Run
Details|contains:
- \ProgramData\
- \Users\Public\
- \AppData\
- \Temp\
filter_common:
Details|contains:
- \Microsoft\OneDrive\
- \Microsoft\Teams\
- \Programs\Zoom\
condition: selection and not filter_common
falsepositives:
- Per-user application installers (updaters, chat clients) registering autostart from
AppData
- Software deployment tools staging launchers in ProgramData
level: medium
id: a54d31a0-b0de-5855-b560-16f00b2d0b67
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar18-275a
2 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar18-275a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs