# North Korean FASTCASH malware targets ATM and payment systems

Published: 2025-07-15 · Severity: routine · Sectors: financial-services
Canonical: https://vorant.io/reports/6627b4ea-af1f-590f-bc97-a50de39e12df/north-korean-fastcash-malware-targets-atm-and-payment-systems

> CISA identifies North Korean HIDDEN COBRA RAT variants that intercept and modify ATM and payment transactions via API hooking.

CISA, FBI, and DoD have analyzed FASTCASH, a remote access tool attributed to North Korea's HIDDEN COBRA group. The malware comprises a DLL injector and a malicious DLL that hooks Windows Send and Recv APIs to intercept financial transaction messages. FASTCASH specifically targets ISO 8583 payment messages originating from ATM systems, point-of-sale terminals, and ATM balance inquiries. When the malware detects transactions from configured Primary Account Numbers (PANs) stored in an encrypted configuration file, it can craft forged authorization responses to approve fraudulent withdrawals or bypass transaction denylists. The malware logs all activity to encrypted files and uses AES encryption and XOR ciphers to protect its configuration and operational data.

The toolset leverages legitimate open-source libraries (hashmap, Microsoft Detours API hooking framework, and ISO 8583 parsing code from GitHub) with modifications to support EBCDIC encoding used in some banking systems. Three submitted files include a DLL injector (switch.exe), the transaction-hijacking DLL (switch.dll), and a variant with enhanced capabilities targeting port 7029 for financial messaging. The malware operates by attaching to running processes, hooking their network APIs, and transparently modifying or denying specific transactions. It maintains detailed logs of intercepted and modified messages for attacker review. No evidence of active exploitation in the wild is mentioned in this analysis report.

## Mentioned in this report

- Threat actors: Lazarus Group
- Malware: FastCash

## Detection guidance (public sample)

### Detours Syelog Named Pipe Created

ATT&CK: T1055

Detects creation of the \syelog named pipe used by the Microsoft Detours logging library, which FASTCASH-style API-hooking implants embed to log intercepted traffic. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Detours Syelog Named Pipe Created
description: Detects creation of the named pipe used by the Microsoft Detours syelog
  logging component. FASTCASH builds on Detours to hook Windows Send/Recv APIs in
  running processes, so an unexpected syelog pipe on a server can indicate API hooking
  tooling.
tags:
- attack.stealth
- attack.privilege-escalation
- attack.t1055
- attack.credential-access
- attack.t1056.004
logsource:
  category: pipe_created
  product: windows
detection:
  selection:
    PipeName: \syelog
  condition: selection
falsepositives:
- Developers or test systems running Microsoft Detours sample tooling or syelog
- Legitimate software that embeds the Detours syelog library for diagnostics
level: medium
id: 9f9e260b-9e8d-58c4-8477-7ea7064e9179
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-239c
```

### Remote Thread LoadLibrary Injection From Non-Standard Process

ATT&CK: T1055

Detects a process outside standard install paths creating a remote thread whose start function is LoadLibrary, the DLL injection pattern used by FASTCASH's injector to load its hooking DLL. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Remote Thread LoadLibrary Injection From Non-Standard Process
description: Detects CreateRemoteThread into another process with LoadLibraryA/W as
  the start function, launched from an executable outside Windows and Program Files
  directories. This is the classic DLL injection technique used by an injector that
  attaches to running processes and loads a Send/Recv API hooking DLL.
tags:
- attack.stealth
- attack.privilege-escalation
- attack.t1055
logsource:
  category: create_remote_thread
  product: windows
detection:
  selection:
    StartFunction:
    - LoadLibraryA
    - LoadLibraryW
  filter_system:
    SourceImage|startswith:
    - C:\Windows\
    - C:\Program Files\
    - C:\Program Files (x86)\
  condition: selection and not filter_system
falsepositives:
- Custom in-house or third-party monitoring and hooking agents installed outside Program
  Files
- Software debuggers and game or overlay tools that inject DLLs
level: medium
id: 50a5fcdf-2c2d-507f-99fb-799b32c79712
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-239c
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-239c

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6627b4ea-af1f-590f-bc97-a50de39e12df/north-korean-fastcash-malware-targets-atm-and-payment-systems.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup