Federal Agencies Warn North Korean Hackers Have Upgraded Their Cash-Out Schemes

A faction of North Korea’s General Reconnaissance Bureau associated with the methodical infiltration of financial institutions to steal money from around the world is back in action with improved capabilities, according to a technical advisory by the Cybersecurity and Infrastructure Security Agency, along with the Treasury Department, U.S. Cyber Command and the FBI.  

The group known as the BeagleBoyz has been tied to incidents dating back to 2015—including the theft of $81 million from the Bank of Bangladesh in 2016—and are thought to have amassed at least $2 billion since then through cyber-enabled means.  

But the impact is bigger than the financial loss itself, the agencies warned in the advisory released Wednesday, noting the sophistication of the hackers and their ability to undermine confidence in the financial system at large. 

“The BeagleBoyz’s bank robberies pose severe operational risk for individual firms beyond reputational harm and financial loss from theft and recovery costs,” reads the advisory. “Equally concerning, these malicious actors have manipulated and, at times, rendered inoperable, critical computer systems at banks and other financial institutions.”

The BeagleBoyz’ operations, which enable cash-outs from ATMs, were identified in 2018 as “FASTCash.” The latest advisory—”FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks”—says the campaign has seen two significant developments. The hackers can now run the scheme on banks hosting their switch applications on Windows servers, and they’re targeting the connections used to process payments between banks. 

“North Korean cyber actors have demonstrated an imaginative knack for adjusting their tactics to exploit the financial sector as well as any other sector through illicit cyber operations,” Bryan Ware, assistant director of cybersecurity for CISA, said. “CISA and our interagency partners work closely with industry to provide actionable, specific and timely cyber threat information, like today’s alert. Our aim is to disrupt and defeat malicious cyber campaigns and help government and industry partners prioritize resources [at] highest risk to stay one-step ahead of adversaries.”

The advisory included typical recommendations for all entities, such as keeping operating system patches up to date, and specific recommendations for financial institutions, including those with ATMs and point-of-sale devices. 

“Treasury’s office of cybersecurity and critical infrastructure protection continues to aggressively coordinate with our government, international, and private sector partners to reduce the threat to the global financial sector posed by North Korean and other sophisticated cyber actors,” Dave Lacquement, deputy assistant secretary for the Treasury office, said. “This is a team effort that requires increased operational collaboration and information sharing to ensure the security and resilience of the financial sector.” 

Representatives from U.S. Cyber Command and the FBI highlighted their respective missives of understanding the adversary by focusing on the away game and imposing consequences. 

But the BeagleBoyz are extremely disciplined, according to the advisory, and typically clean up as they try to clean out the banks, making them difficult to track.

They typically use malware, such as one identified as ECCENTRICBANDWAGON to gain credentials by logging keystrokes and taking screen captures. Federal agencies have also previously warned of their use of malware that allows them remote access to command and control victim organizations from the inside. Those include HOPLIGHT, and CROWDFLOUNDER, proxies of which are known as ELECTRICFISH and VIVACIOUSGIFT. The advisory links to analyses of the various malware. 

As their operations proceed, the BeagleBoyz then “remove the malware, tools, or other non-native files dropped or created throughout an intrusion to reduce their footprint or as part of the post-intrusion cleanup process,” the advisory states. They also encrypt their communications to make detection more difficult.

The agencies note that the nation-state actors may also be working with or contracting out to criminal hacking groups, especially to plant commodity malware through phishing or watering hole attacks that establish initial access. The criminal groups then hand things over to the BeagleBoyz, who may not follow up with their exploits until months later, the advisory said.