"FASTCash" is Not a "Linux" Thing, It Was Merely Extended to Also Have a Variant for Already-Compromised Ubuntu 22.04

posted by Roy Schestowitz on Oct 18, 2024

SOME days ago we spotted and took note of this article from a Microsoft-connected site. We thought it was safe to ignore because it was just one piece, it seems like overhyped (or dramatised, anti-Linux) "reporting" that wrongly attributes to Linux something that can merely run on some old version of it, and we didn't want to give it undeserved attention. A quick rebuttal in editorial comments is typically enough. But hours later we saw lots of this in "news" sites, typically citing the Microsoft-connected site, e.g. [1-7].

An associate explained that "it is part of a trend of disparaging "Linux" and OSS in general. As mentioned earlier [previous articles, too] it is very likely to accompany the lobbying taking place at the moment in DC."

"Same for the push for 'passkeys' and other proprietary gimmicks, all of which increase surveillance and reduce options -- especially FOSS options. Andy wrote about this last month."

From what we can gather, all the articles below basically say that there is some bit of malicious software and it can be executed in several operating systems. Recently it was also seen executed on Ubuntu 22.04, but that does not mean that this software can just break into Ubuntu 22.04. It's most likely the case that some weak password, misconfiguration or badly out-of-date software lets someone get in, then install the malware.

Is that the fault of Linux? No. But notice these daunting headlines. █

Related/contextual items from the news:

1. North Korean hackers utilizing Linux tool to hack ATMs

   North Korean hackers are using a new tool to steal cash from ATMs: a Linux variant of FASTCash malware. This malware has been used in some form since 2016 and has stolen tens of millions of dollars in cash through unauthorized withdrawals at ATMs, according to a report by Bleeping Computer.

2. A new Linux variant of FASTCash malware targets financial systems

   North Korea-linked actors deploy a new Linux variant of FASTCash malware to target financial systems, researcher HaxRob revealed.

   The cybersecurity researcher HaxRob analyzed a new variant of the FASTCash “payment switch” malware which targets Linux systems. The variant discovered by the researcher was previously unknown and targets Ubuntu 22.04 LTS distributions.

3. North Korean hackers use newly discovered Linux malware to raid ATMs

   In the beginning, North Korean hackers compromised the banking infrastructure running AIX, IBM’s proprietary version of Unix. Next, they hacked infrastructure running Windows. Now, the state-backed bank robbers have expanded their repertoire to include Linux.

   The malware, tracked under the name FASTCash, is a remote access tool that gets installed on payment switches inside compromised networks that handle payment card transactions. The US Cybersecurity and Infrastructure Security Agency first warned of FASTCash in 2018 in an advisory that said the malware was infecting AIX-powered switches inside retail payment networks. In 2020, the agency updated its guidance to report FASTCash was now infecting switches running Windows as well. Besides embracing Windows, FASTCash had also expanded its net to include not just switches for retail payments but those handled by regional interbank payment processors as well.

4. North Korea Hackers Get Cash Fast in Linux Cyber Heists

   North Korean threat actors are using a Linux variant from a malware family known as "FASTCash" to conduct a financially motivated cyber campaign.

5. A new Linux-based FASTCash malware steals money from ATMs

   The new FASTCash malware has a new variant for Linux that helps North Korean hackers breach ATMs and execute unauthorised money withdrawals.

   According to reports, previous malware versions could only target IBM and Windows computers, but a new variant has emerged that can target the Ubuntu 22.04 LTS distributions.

6. North Korean Hackers Deploy Linux FASTCash Malware for ATM Cashouts

   North Korean hackers target Linux-based payment switches with new FASTCash malware, enabling ATM cashouts. Secure your financial infrastructure and protect against these sophisticated attacks with expert cybersecurity solutions.

7. FASTCash GNU/Linux Malware: A New Cybercrime Menace Targeting Payment Switch Systems

   As malware threats evolve to increasingly target GNU/Linux systems, admins and organizations must stay up-to-date on the latest GNU/Linux malware variants and strategies for detecting and preventing attacks. Security researcher HaxRob recently discovered a new GNU/Linux variant of the FASTCash malware , which targets payment switches to enable unauthorized ATM withdrawals.