Loading story…
CISA warned that North Korean state-sponsored operators tracked as BeagleBoyz were conducting FASTCash 2.0 campaigns to steal money from financial institutions by compromising payment-switch infrastructure and enabling fraudulent ATM cash-outs. The activity targeted banks and payment processors, allowing attackers to manipulate transaction processing and authorize withdrawals that should have been declined, turning internal access to banking networks into direct theft.
The advisory linked the operations to North Korea’s broader financially motivated cyber program and described FASTCash as an evolution of earlier bank heists aimed at generating revenue for the regime. CISA urged financial institutions to harden payment environments, monitor for anomalous switch activity and unauthorized administrative access, segment critical systems, and review indicators and tactics associated with BeagleBoyz intrusions to detect and disrupt fraudulent cash-out activity.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
CISA published alert AA20-239A, "FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks," describing North Korean BeagleBoyz operations targeting banks and related financial infrastructure. The advisory provided technical and threat information about the campaign.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean state-backed hacking groups, including Lazarus, Andariel, and Kimsuky, have been identified as leading actors in global nation-state cyberattacks, accounting for 18.2% of all such activity between April and September. These groups have adopted increasingly sophisticated tactics, such as "malware-free" intrusions, covert infiltration schemes, and the use of legitimate system tools like PowerShell and Command Prompt to evade detection. Telecommunications, technology, and transportation sectors have been the primary targets, with Turkey and the U.S. among the most frequently attacked nations. Security experts recommend layered defenses and zero-trust principles to counter these evolving threats. A recent report by the Multilateral Sanctions and Measures Team (MSMT), with contributions from Chainalysis, reveals that North Korea has stolen an estimated $2.8 billion in cryptocurrency from January 2024 to September 2025, including a $1.5 billion heist from the Bybit exchange. The report highlights the expansion of North Korea's laundering networks, which now involve sophisticated mixing services, OTC brokers across multiple jurisdictions, and collaboration with Russian and Cambodian money laundering networks. The use of UnionPay cards and Hong Kong-based intermediaries further complicates efforts to trace and recover stolen assets, underscoring the growing scale and complexity of North Korean cyber operations.
Jun 29, 2026
North Korean authorities reportedly arrested members of an insider cybercrime ring accused of breaching the internal networks of **Chosun Central Bank** and **Foreign Trade Bank** and siphoning off state trade funds and foreign currency. According to reporting cited in a related social media post, the group included former North Korean cyber operations personnel and younger IT specialists, making the case notable because the suspects were allegedly state-trained insiders tied to elite military cyber and technical institutions. Investigators reportedly uncovered discrepancies in foreign payment approvals and suspicious overseas IP access before launching a covert probe that culminated in raids and arrests in Pyongyang. The suspects allegedly moved stolen funds through shell accounts, converted proceeds into cryptocurrency, and relied on brokers and border-area contacts to launder the money back into **U.S. dollars** and **Chinese yuan**, exposing a breach that struck core parts of North Korea’s financial system.
Jul 24, 2026
The United States has tied North Korea’s **Lazarus Group** and related DPRK cyber operators to a long-running campaign of financially motivated intrusions, sanctions evasion, and destructive attacks, describing the activity as a revenue source for Pyongyang’s weapons programs. U.S. government advisories and enforcement actions link the regime-backed operators—also tracked as **HIDDEN COBRA**—to major incidents including the **Sony Pictures** attack, the **Bangladesh Bank SWIFT** theft, **WannaCry 2.0**, **FASTCash** ATM cash-out operations, and repeated compromises of cryptocurrency businesses and exchanges. Treasury, DOJ, and FBI actions have named and charged North Korean operatives and their facilitators, including sanctions on individuals accused of supporting Lazarus and laundering stolen virtual assets. U.S. authorities said Lazarus stole hundreds of millions of dollars from the **Ronin** network tied to Axie Infinity, while other cases alleged more than **$100 million** in cryptocurrency laundering tied to exchange hacks. Officials said the campaign has generated billions in illicit proceeds and warned that financial institutions, crypto firms, and infrastructure operators face continued risk from DPRK-linked theft, money laundering, extortion, and related cyber activity.
Aug 15, 2026