Security researcher HaxRob disclosed a new Linux variant of the FASTCash malware, tracked as libMyFc.so, attributed to North Korean state-sponsored operators (Lazarus Group / HIDDEN COBRA). Historically targeting Windows and IBM AIX platforms, this variant is compiled as an ELF shared object for Ubuntu payment switches. Operators inject the library into running payment switch daemons via the ptrace system call, subsequently utilizing the subhook library to intercept socket functions and transaction processing loops.

The implant parses financial traffic conforming to the ISO 8583 protocol, matching cardholder records against an AES-128-CBC encrypted configuration stored at /tmp/info.dat. When core banking networks transmit transaction denial messages due to insufficient balances, libMyFc.so modifies responses in-flight into approved transaction reply codes (0210 response code 00). This in-memory manipulation enables synchronized ATM cash-out operations across financial institutions while bypassing core balance validation routines.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: In-process manipulation of ISO 8583 messaging via runtime function hooking intercepts financial transactions downstream of transport encryption, bypassing boundary controls and core balance verification without modifying underlying database records.
• Bullet 2 — Strategic & Defender Imperative: Financial institutions must enforce runtime process integrity monitoring (YARA/auditd) on Linux switch infrastructure, restrict non-privileged ptrace access via yama LSM controls, and implement cryptographic message authentication codes (MACs) across core banking interconnects.