North Korean elite hacker team Lazarus has been wreaking havoc to many Automated Teller Machines located in Africa and Asia for the last two years. The FastCash attacks are a modified man-in-the-middle play, where the trojan uses malformed withdrawal request, which ATMs still accept as valid, hence unauthorized transactions get completed. To date, the Lazarus FASTCash operation is estimated to have stolen tens of millions of dollars. It is possible the attackers are opening accounts themselves and making withdrawal requests with cards issued to those accounts.”]
Source: https://hackercombat.com/a-careful-look-on-fastcash-the-new-cash-cow-of-lazarus-hacking-group/