Threat taxonomy
medium activityFinancial MalwareFirst seen 2022
SwitchCrawler
Aliases: SWC
A modular toolset for enumerating and manipulating card payment switches, including transaction response tampering used to approve withdrawals against blocked accounts.
Attribution
Criminal toolset for payment infrastructure
Primary targets
- — Payment switches
- — ATM controllers
- — Card issuers
Observed tactics
- ISO 8583 message tampering
- Persistence on switch adjacent jump hosts
- Log suppression during cash-out windows
Regional relevance
Shared national switch infrastructure raises the blast radius of a single compromised participant.
Detection guidance
- Reconcile switch approvals against core banking balances hourly
- Alert on unexpected processes on switch hosts
- Monitor for gaps in transaction logging
Related feed reporting
- critical14 Sept 2026
Credential-harvesting kit impersonates Ethiopian national payment switch
- medium03 Sept 2026
ATM switch manipulation attempt blocked at an East African bank
- high27 Aug 2026
Infostealer logs containing banking VPN credentials sold in bulk