After being installed on a payment switch server’s running process through the ‘ptrace’ system call, FASTCash for Linux — which significantly resembled iterations of the malware for Windows and AIX — facilitates ISO8583 transaction message interception and alteration, according to cybersecurity researcher HaxRob, who discovered the updated variant. Bank approval of the manipulated messages, which specify amounts ranging from 12,000 and 30,000 Turkish Lira, would then enable ATM withdrawals by a money mule.

Source: SC Magazine