North Korean FASTCASH malware targets ATM and payment systems
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CISA identifies North Korean HIDDEN COBRA RAT variants that intercept and modify ATM and payment transactions via API hooking.
CISA, FBI, and DoD have analyzed FASTCASH, a remote access tool attributed to North Korea's HIDDEN COBRA group. The malware comprises a DLL injector and a malicious DLL that hooks Windows Send and Recv APIs to intercept financial transaction messages. FASTCASH specifically targets ISO 8583 payment messages originating from ATM systems, point-of-sale terminals, and ATM balance inquiries. When the malware detects transactions from configured Primary Account Numbers (PANs) stored in an encrypted configuration file, it can craft forged authorization responses to approve fraudulent withdrawals or bypass transaction denylists. The malware logs all activity to encrypted files and uses AES encryption and XOR ciphers to protect its configuration and operational data.
The toolset leverages legitimate open-source libraries (hashmap, Microsoft Detours API hooking framework, and ISO 8583 parsing code from GitHub) with modifications to support EBCDIC encoding used in some banking systems. Three submitted files include a DLL injector (switch.exe), the transaction-hijacking DLL (switch.dll), and a variant with enhanced capabilities targeting port 7029 for financial messaging. The malware operates by attaching to running processes, hooking their network APIs, and transparently modifying or denying specific transactions. It maintains detailed logs of intercepted and modified messages for attacker review. No evidence of active exploitation in the wild is mentioned in this analysis report.
Mentioned in this report
Detection guidance
Detours Syelog Named Pipe Created
Detects creation of the \syelog named pipe used by the Microsoft Detours logging library, which FASTCASH-style API-hooking implants embed to log intercepted traffic. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Detours Syelog Named Pipe Created
description: Detects creation of the named pipe used by the Microsoft Detours syelog
logging component. FASTCASH builds on Detours to hook Windows Send/Recv APIs in
running processes, so an unexpected syelog pipe on a server can indicate API hooking
tooling.
tags:
- attack.stealth
- attack.privilege-escalation
- attack.t1055
- attack.credential-access
- attack.t1056.004
logsource:
category: pipe_created
product: windows
detection:
selection:
PipeName: \syelog
condition: selection
falsepositives:
- Developers or test systems running Microsoft Detours sample tooling or syelog
- Legitimate software that embeds the Detours syelog library for diagnostics
level: medium
id: 9f9e260b-9e8d-58c4-8477-7ea7064e9179
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-239c
Remote Thread LoadLibrary Injection From Non-Standard Process
Detects a process outside standard install paths creating a remote thread whose start function is LoadLibrary, the DLL injection pattern used by FASTCASH's injector to load its hooking DLL. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Remote Thread LoadLibrary Injection From Non-Standard Process
description: Detects CreateRemoteThread into another process with LoadLibraryA/W as
the start function, launched from an executable outside Windows and Program Files
directories. This is the classic DLL injection technique used by an injector that
attaches to running processes and loads a Send/Recv API hooking DLL.
tags:
- attack.stealth
- attack.privilege-escalation
- attack.t1055
logsource:
category: create_remote_thread
product: windows
detection:
selection:
StartFunction:
- LoadLibraryA
- LoadLibraryW
filter_system:
SourceImage|startswith:
- C:\Windows\
- C:\Program Files\
- C:\Program Files (x86)\
condition: selection and not filter_system
falsepositives:
- Custom in-house or third-party monitoring and hooking agents installed outside Program
Files
- Software debuggers and game or overlay tools that inject DLLs
level: medium
id: 50a5fcdf-2c2d-507f-99fb-799b32c79712
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-239c
1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-239c
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs