FastCash

Internal ID: aix.fastcash

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family identifying aix.fastcash. Origin and technical characteristics tracked via Malpedia.

Threat Analysis

FastCash is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf

→https://blog.talosintelligence.com/2019/05/10-years-of-virtual-dynamite.html

→https://doubleagent.net/fastcash-for-linux/

→https://github.com/fboldewin/FastCashMalwareDissected/

→https://i.blackhat.com/USA-20/Wednesday/us-20-Perlow-FASTCash-And-INJX_Pure-How-Threat-Actors-Use-Public-Standards-For-Financial-Fraud-wp.pdf

→https://i.blackhat.com/USA-20/Wednesday/us-20-Perlow-FASTCash-And-INJX_Pure-How-Threat-Actors-Use-Public-Standards-For-Financial-Fraud.pdf

→https://i.blackhat.com/eu-20/Wednesday/eu-20-Rivera-From-Zero-To-Sixty-The-Story-Of-North-Koreas-Rapid-Ascent-To-Becoming-A-Global-Cyber-Superpower.pdf

→https://mal-eats.net/en/2021/05/11/campo_new_attack_campaign_targeting_japan/

→https://symantec-blogs.broadcom.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware

→https://threatrecon.nshc.net/2019/01/23/sectora01-custom-proxy-utility-tool-analysis/

Quick Facts

TypeAPT / Threat Group

Aliases1

Also Known As

aix.fastcash

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search FastCash