SafeBreach Hacker's Playbook Updated for US-CERT Alert (AA20-239A) FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks
US Cert Alerts
SafeBreach Labs has updated the Hacker's Playbook™ with new attack methods for malware samples described in US-CERT FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks which addresses yet another serious attack from the Democratic People’s Republic of Korea (DPRK). The BeagleBoyz is identified as a new Threat Group, which is made up of Lazarus Group and APT38 that specifically targets Financial Institutions. The attack is focused on financial gain by accessing bank accounts to steal money from ATMs and also through SWIFT to transfer funds.
The North Korean threat groups are notorious for devastating attacks, including the infamous WannaCry attack in 2017 from Lazarus Group, the attack against Sony Pictures in 2014 in retaliation for ‘The Interview’ film by Guardians of Peace, and the Bangladesh Bank Heist in 2016 where \$81 million was stolen via the SWIFT network, among others. SafeBreach Labs has been tracking their progress and updating the SafeBreach Hacker’s Playbook throughout the years.
Here is an overview SafeBreach Hacker’s Playbook timeline based on US-Cert Alert updates only:
Similar to most DPRK attacks, the BeagleBoyz uses numerous TTPs and malware samples, most of which are already covered in the SafeBreach Hacker’s Playbook. The new attack methods have been added based on this latest US-CERT Alert.
5 attack methods already covered
#5413 - Write ar20-239a malware to disk (Host-Level)
#5414 - Transfer of ar20-239a malware over HTTP/S (Lateral Movement)
#5415 - Transfer of ar20-239a malware over HTTP/S (Infiltration)
#5416 - Email ar20-239a malware as a ZIP attachment (Lateral Movement)
#5417 - Email ar20-239a malware as a ZIP attachment (Infiltration)
#5429 - Pre-execution phase of aa20-239a_FASTCash_MSIL_exe malware (Host-Level)
#5430 - Write aa20-239a_FASTCash_MSIL_exe malware to disk (Host-Level)
#5431 - Transfer of aa20-239a_FASTCash_MSIL_exe malware over HTTP/S (Lateral Movement)
#5432 - Transfer of aa20-239a_FASTCash_MSIL_exe malware over HTTP/S (Infiltration)
#5433 - Email aa20-239a_FASTCash_MSIL_exe malware as a ZIP attachment (Lateral Movement)
#5434 - Email aa20-239a_FASTCash_MSIL_exe malware as a ZIP attachment (Infiltration)
7 attack methods already covered
5 existing attack methods already covered
23 existing attack methods already covered
Looking back at North Korean attacks on financial institutions BeagleBoyz could be attributed to cyber-enabled financial theft and money laundering, extortion campaigns, and cryptojacking. It is clear they are attacking for financial gain, with estimated thefts of \$2 billion to date.
The new attack methods for US-CERT AA20-239A are already in the SafeBreach Hacker’s Playbook and ready to be run across your simulators. The Known Attack Series report is being updated so you can run specifically the attacks from this US-CERT alert. From the Known Attack Series report, select the US-CERT Alert AA20-239A (FastCash 2.0) report and select Run Simulations which will run all the attack methods.