Federal Agencies Warn North Korean Hackers Have Upgraded Their Cash-Out Schemes
A joint alert shared details of tactics and malware used by a state subgroup the U.S. government calls the BeagleBoyz.
By
A faction of North Korea’s General Reconnaissance Bureau associated with the methodical infiltration of financial institutions to steal money from around the world is back in action with improved capabilities, according to a technical advisory by the Cybersecurity and Infrastructure Security Agency, along with the Treasury Department, U.S. Cyber Command and the FBI.
The group known as the BeagleBoyz has been tied to incidents dating back to 2015—including the theft of $81 million from the Bank of Bangladesh in 2016—and are thought to have amassed at least $2 billion since then through cyber-enabled means.
But the impact is bigger than the financial loss itself, the agencies warned in the advisory released Wednesday, noting the sophistication of the hackers and their ability to undermine confidence in the financial system at large.
“The BeagleBoyz’s bank robberies pose severe operational risk for individual firms beyond reputational harm and financial loss from theft and recovery costs,” reads the advisory. “Equally concerning, these malicious actors have manipulated and, at times, rendered inoperable, critical computer systems at banks and other financial institutions.”
The BeagleBoyz’ operations, which enable cash-outs from ATMs, were identified in 2018 as “FASTCash.” The latest advisory—”FASTCash 2.0: North Korea’s BeagleBoyz Robbing Banks”—says the campaign has seen two significant developments. The hackers can now run the scheme on banks hosting their switch applications on Windows servers, and they’re targeting the connections used to process payments between banks.
“North Korean cyber actors have demonstrated an imaginative knack for adjusting their tactics to exploit the financial sector as well as any other sector through illicit cyber operations,” Bryan Ware, assistant director of cybersecurity for CISA, said. “CISA and our interagency partners work closely with industry to provide actionable, specific and timely cyber threat information, like today’s alert. Our aim is to disrupt and defeat malicious cyber campaigns and help government and industry partners prioritize resources [at] highest risk to stay one-step ahead of adversaries.”
The advisory included typical recommendations for all entities, such as keeping operating system patches up to date, and specific recommendations for financial institutions, including those with ATMs and point-of-sale devices.
“Treasury’s office of cybersecurity and critical infrastructure protection continues to aggressively coordinate with our government, international, and private sector partners to reduce the threat to the global financial sector posed by North Korean and other sophisticated cyber actors,” Dave Lacquement, deputy assistant secretary for the Treasury office, said. “This is a team effort that requires increased operational collaboration and information sharing to ensure the security and resilience of the financial sector.”
Representatives from U.S. Cyber Command and the FBI highlighted their respective missives of understanding the adversary by focusing on the away game and imposing consequences.
But the BeagleBoyz are extremely disciplined, according to the advisory, and typically clean up as they try to clean out the banks, making them difficult to track.
They typically use malware, such as one identified as ECCENTRICBANDWAGON to gain credentials by logging keystrokes and taking screen captures. Federal agencies have also previously warned of their use of malware that allows them remote access to command and control victim organizations from the inside. Those include HOPLIGHT, and CROWDFLOUNDER, proxies of which are known as ELECTRICFISH and VIVACIOUSGIFT. The advisory links to analyses of the various malware.
As their operations proceed, the BeagleBoyz then “remove the malware, tools, or other non-native files dropped or created throughout an intrusion to reduce their footprint or as part of the post-intrusion cleanup process,” the advisory states. They also encrypt their communications to make detection more difficult.
The agencies note that the nation-state actors may also be working with or contracting out to criminal hacking groups, especially to plant commodity malware through phishing or watering hole attacks that establish initial access. The criminal groups then hand things over to the BeagleBoyz, who may not follow up with their exploits until months later, the advisory said.
*********
(TLB) published this article from NextGov.com with our appreciation for this coverage of an important issure.
The Liberty Beacon urges you to visit NextGov.com for articles that will help move you into the future.
••••
••••
Stay tuned to …
••••
The Liberty Beacon Project is now expanding at a near exponential rate, and for this we are grateful and excited! But we must also be practical. For 7 years we have not asked for any donations, and have built this project with our own funds as we grew. We are now experiencing ever increasing growing pains due to the large number of websites and projects we represent. So we have just installed donation buttons on our websites and ask that you consider this when you visit them. Nothing is too small. We thank you for all your support and your considerations … (TLB)
••••
Comment Policy: As a privately owned web site, we reserve the right to remove comments that contain spam, advertising, vulgarity, threats of violence, racism, or personal/abusive attacks on other users. This also applies to trolling, the use of more than one alias, or just intentional mischief. Enforcement of this policy is at the discretion of this websites administrators. Repeat offenders may be blocked or permanently banned without prior warning.
••••
Disclaimer: TLB websites contain copyrighted material the use of which has not always been specifically authorized by the copyright owner. We are making such material available to our readers under the provisions of “fair use” in an effort to advance a better understanding of political, health, economic and social issues. The material on this site is distributed without profit to those who have expressed a prior interest in receiving it for research and educational purposes. If you wish to use copyrighted material for purposes other than “fair use” you must request permission from the copyright owner.
••••
Disclaimer: The information and opinions shared are for informational purposes only including, but not limited to, text, graphics, images and other material are not intended as medical advice or instruction. Nothing mentioned is intended to be a substitute for professional medical advice, diagnosis or treatment.
Leave a Reply