FASTCash and INJX_Pure: How Threat Actors Use Public Standards for Financial Fraud

No ratings

Presented at BlackHat USA 2020 by

Kevin Perlow

The INJX_Pure and Lazarus FASTCash malware families are each built on publicly documented standards that enable their respective operating threat actors to perform financial "cash outs" at ATMs. While each of these malware families leverages a different standard to do this, they both demonstrate that their authors and operators possess strong programming abilities *and* a knowledge of the underlying mechanics of a financial card transaction.Unfortunately, for many defenders, this knowledge is fragmented: reverse engineers often possess granular knowledge of these tools' technical characteristics but only high-level knowledge of why these tools actually work. Likewise, financial analysts are likely to possess in-depth knowledge of the "cash out" mechanics of these tools but not a granular understanding of how they operate.This presentation seeks to bridge this gap for both parties. With a focus on ISO-8583 and eXtensions for Financial Services (XFS), this talk will offer analysts an opportunity to understand the underlying, publicly documented standards that allow these malware families to operate. Attendees will learn how knowledge of these standards provides invaluable information that can be used to build a preliminary intelligence snapshot regarding the adversaries' intrusions and tooling capabilities. In addition, the presentation will explore some of the operational advantages and disadvantages inherent in choosing to use this type of malware.