Article
The Lazarus Group: Espionage, Sabotage, and Cybercrime Under One Umbrella
Lazarus Group profile: active since at least 2009, with aliases and major incidents such as Sony Pictures, WannaCry and Bybit, plus defense guidance.
Read more
Malware profile
FASTCash
Also known as FASTCash 2.0, FASTCash for UNIX, FASTCash for Windows
FASTCash is the name the US Government gives to an ATM cash-out scheme and the malware behind it.
In short
FASTCash is the name the US Government gives to an ATM cash-out scheme and the malware behind it. The malware runs on a bank payment switch server, reads card request messages and sends back fake approvals, so cash can leave ATMs in many countries at once.
- Names3names in public reportsFASTCash 2.0 · FASTCash for UNIX · FASTCash for Windows
- Infection Steps6in the delivery chainGain access · Prepare the server
- Linked Groups2groups that use itAPT38 · Lazarus Group
In one minute
- What it is
- The US Government's name for an ATM cash-out scheme, and the malware used on bank payment switch servers (AIX and Windows versions).
- What it does
- Reads card request messages on the switch, answers chosen account numbers with fake approvals, and lets criminals withdraw cash at ATMs in many countries.
- Who uses it
- Attributed by DHS, Treasury and FBI (October 2018) to the North Korean government. Attributed by CISA, Treasury, FBI and US Cyber Command (August 2020) to a team they call BeagleBoyz. The US Department of Justice (February 2021) charged three men it says belong to North Korean military units.
- How it gets in
- CISA says the first way in is unknown. Switch servers in the 2018 cases ran unsupported AIX versions, but no AIX exploit was proven.
- What to do first
- Read the CISA reports TA18-275A and AR18-275A for indicators, and check root shell history and access to the payment switch server.
What it does
FASTCash is not one file. CISA describes a scheme in which attackers take over the server that approves card transactions at a bank, then use malware on that server to answer ATM requests themselves. Two versions are described, one for IBM AIX servers and one for Windows servers.
The reports say the malware only answers for chosen account numbers, and other traffic passes through as normal. Most accounts used to start the withdrawals had little activity or a zero balance.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| FASTCash 2.0 | Title of CISA advisory AA20-239A, "FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks"[3] |
| FASTCash for UNIX | Name for the AIX version in CISA advisory AA20-239A[3] |
| FASTCash for Windows | Name for the Windows version in AA20-239A and in CISA report AR20-239C[3, 4] |
How it spreads
CISA says the first way into victim networks is unknown. All compromised switch servers in the 2018 report ran unsupported AIX versions, but there is no evidence the operating system was exploited. A later advisory says the group behind FASTCash has used spearphishing and watering holes to get into financial institutions in general.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Gain access
The attackers compromise a bank's payment switch application server. CISA says how they get in is unknown.[1]
Prepare the server
They deploy malware and likely ISO 8583 libraries, which help read card request messages and build replies.[1]
Inject into a running process
On AIX the malware injects code into a process that is already running. The Windows version injects itself into the switch software and takes over its send and receive functions.[1, 3]
Match chosen accounts
The malware checks incoming request messages for specific account numbers. Other messages pass through as normal.[1, 3]
Send fake approvals
For matching requests it blocks the real denial and returns a fraudulent but legitimate-looking approval.[1]
Cash out
Cash is withdrawn from ATMs at the same time, across borders.[1]
Timeline
- Late 2016
Campaign begins
CISA says the actors have used FASTCash tactics against banks in Africa and Asia since at least late 2016.[1]
- 2017
Withdrawals in over 30 countries
In one incident, cash was withdrawn at the same time from ATMs in over 30 countries.[1]
- 2018
Withdrawals in 23 countries
In another incident, cash was withdrawn at the same time from ATMs in 23 countries.[1]
- October 2018
Pakistani bank theft
The Department of Justice says FASTCash included the October 2018 theft of $6.1 million from a Pakistani bank.[5]
- October 2, 2018
CISA alert TA18-275A
DHS, Treasury and FBI publish the first FASTCash alert.[1]
- November 8, 2018
Malware report published
CISA says the first version of MAR-10201537 was published on this date.[2]
- December 21, 2018
Malware report updated
CISA updates the report: two files first judged harmless are found to be malicious.[2]
- August 26, 2020
FASTCash 2.0 advisory
CISA, Treasury, FBI and US Cyber Command publish AA20-239A with a Windows version and new targets.[3]
- February 17, 2021
Justice Department indictment
The Department of Justice announces charges and names FASTCash among the schemes.[5]
Who uses it
- Threat group APT38 APT38 is a North Korean state-sponsored group focused on financial theft, attributed by MITRE ATT&CK to North Korea's Reconnaissance General Bureau. North Korea · Since 2014
- Threat group Lazarus Group Lazarus Group is the name used by MITRE, the US Treasury and the US Department of Justice for North Korean hacking units that, they say, work for the Reconnaissance General Bureau. North Korea · Since 2009
Detection and defense
Use the official detection resources
CISA alert TA18-275A and malware analysis report MAR-10201537 (AR18-275A) carry the FASTCash indicators. AA20-239A and report AR20-239C cover the Windows version. CISA says to feed the indicators into detection systems and also warns that signatures alone are not enough.[1, 2, 3, 4]
Review root shell history
CISA recommends reviewing bash history logs of all users with root privileges on the switch server, and logging and monitoring all commands.[1]
Split the network
Use firewalls to divide the environment into enclaves and access control lists to allow or block traffic between them.[1]
Watch transactions and software
Set a baseline of normal software, users, logins and transaction patterns on the switch, and flag anything outside it.[1]
Questions
What is FASTCash?
It is the US Government's name for an ATM cash-out scheme. Malware on a bank's payment switch server sends fake approvals so cash can be withdrawn at ATMs in many countries at once (CISA TA18-275A).
Who is behind FASTCash?
The US Government attributes it to the North Korean government. CISA's 2020 advisory names a team it calls BeagleBoyz, and the Department of Justice charged three men in February 2021.
Which systems does it run on?
CISA describes a version for IBM AIX servers and a version for Windows servers, both built around the ISO 8583 message standard.
How do banks get in?
CISA says the first way in for the 2018 cases is unknown. Its 2020 advisory says the team has used spearphishing and watering holes against financial institutions in general.
How can a bank defend against it?
CISA recommends multi-factor authentication on the switch server, network separation, chip and PIN checks with cryptogram validation, and monitoring of transactions and root shell history.
In our research
- The Lazarus Group: Espionage, Sabotage, and Cybercrime Under One Umbrella October 2025
- APT38 Threat group
- Lazarus Group Threat group
Sources
- HIDDEN COBRA FASTCash Campaign, TA18-275A CISASupports: Scheme description, AIX malware, countries, timing, mitigations, detection advice.
- MAR-10201537 HIDDEN COBRA FASTCash-Related Malware, AR18-275A CISASupports: Malware analysis, ISO 8583 modification, report dates.
- FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks, AA20-239A CISASupports: Windows version, BeagleBoyz attribution, interbank processors, mitigations.
- MAR-10257062-1.v2 North Korean Remote Access Tool: FASTCASH for Windows, AR20-239C CISASupports: Windows malware analysis.
- Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe US Department of JusticeSupports: FASTCash named in indictment, a Pakistani bank theft, group names, money laundering.
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.