April 28, 2016 By Larry Loeb 2 min read

The story of the February cyberattack on the Bank of Bangladesh that sought $1 billion — and achieved $81 million — keeps looking more and more like a Hollywood caper movie.

The first account of the attack said it was detected by a misspelling, which prompted an employee of the victimized SWIFT banking network to look into it. Further stories came out insinuating that the Bangladesh network was actually undone by insecure and cheap routers.

Brussels-based SWIFT is central to interbank functioning; it is the financial nerve system of the world. So what really happened when it came under attack?

More Sophisticated Than First Believed

A new story has evolved, one far more menacing than bad routers. Security researchers at BAE Systems found tools lurking in malware repositories. They think the tools are connected to the attacks, stating, “The custom malware was submitted by a user in Bangladesh and contains sophisticated functionality for interacting with local SWIFT Alliance Access software running in the victim infrastructure.”

The tools seem to have been designed as part of an overall attack toolkit for SWIFT. The tools discovered were used to cover the attackers’ tracks while they sent payment instructions. By hiding their tracks, the attackers would have made detection harder, thus giving more time for money laundering to take place.

“The tools are highly configurable and, given the correct access, could feasibly be used for similar attacks in the future,” BAE Systems noted in its blog. “The tool was custom-made for this job and shows a significant level of knowledge of SWIFT Alliance Access software as well as good malware coding skills.”

The malware creator knew exactly how the SWIFT software functioned and what to do in order to bypass it. This was no random job: It was a targeted operation done using good intelligence.

SWIFT Banking Network Responds

SWIFT posted a response to all of this. “Contrary to reports that suggest otherwise, this malware has no impact on SWIFT’s network or core messaging services,” the network claimed.

“We have developed a facility to assist customers in enhancing their security and to spot inconsistencies in their local database records, however, the key defense against such attack scenarios remains for users to implement appropriate security measures in their local environments to safeguard their systems.”

The SWIFT banking network is shining the spotlight on the member banks, but it still has a serious problem: Someone knows just how to play the system. This exploit didn’t work all the way, but the next one might. The stakes are huge and call for the strongest possible response.

More from

ITG05 operations leverage Israel-Hamas conflict lures to deliver Headlace malware

11 min read - As of December 2023, IBM X-Force has uncovered multiple lure documents that predominately feature the ongoing Israel-Hamas war to facilitate the delivery of the ITG05 exclusive Headlace backdoor. The newly discovered campaign is directed against targets based in at least 13 nations worldwide and leverages authentic documents created by academic, finance and diplomatic centers. ITG05’s infrastructure ensures only targets from a single specific country can receive the malware, indicating the highly targeted nature of the campaign.X-Force tracks ITG05 as a…

Exploiting GOG Galaxy XPC service for privilege escalation in macOS

7 min read - Being part of the Adversary Services team at IBM, it is important to keep your skills up to date and learn new things constantly. macOS security was one field where I decided to put more effort this year to further improve my exploitation and operation skills in macOS environments. During my research, I decided to try and discover vulnerabilities in software that I had pre-installed on my laptop, which resulted in the discovery of this vulnerability. In this article, I…

Taking the complexity out of identity solutions for hybrid environments

4 min read - For the past two decades, businesses have been making significant investments to consolidate their identity and access management (IAM) platforms and directories to manage user identities in one place. However, the hybrid nature of the cloud has led many to realize that this ultimate goal is a fantasy. Instead, businesses must learn how to consistently and effectively manage user identities across multiple IAM platforms and directories. As cloud migration and digital transformation accelerate at a dizzying pace, enterprises are left…

IBM identifies zero-day vulnerability in Zyxel NAS devices

12 min read - While investigating CVE-2023-27992, a vulnerability affecting Zyxel network-attached storage (NAS) devices, the IBM X-Force uncovered two new flaws, which when used together, allow for pre-authenticated remote code execution. Zyxel NAS devices are typically used by consumers as cloud storage devices for homes or small to medium-sized businesses. When used together, the flaws X-Force discovered allow a remote attacker to execute arbitrary code on the device with superuser permissions and without requiring any credentials. This results in complete control over the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today