As 2017 comes to a close, the string of recent attacks on SWIFT and other financial messaging systems are emerging as one of the main threat trends. News has just surfaced of another such attack – this time impacting Globex Bank in Russia, which took place on December 15th. Attackers apparently attempted to steal almost $1M by manipulating international transfer requests through the systems within the bank that connect to the SWIFT messaging service.
The threat news of the week is about MoneyTaker – a cybercrime group apparently responsible for theft of over $10M from 18 banks in the US and Russia. If you’ve read any of the online accounts, it’s easy to be overwhelmed by the details and the growing sophistication of cybercrime groups. While it’s important not to downplay their fierceness and the growing risks associated with advanced persistent threats, it’s also important to focus on the relatively simple capability organizations can embrace to combat them.
“Hello darkness, my old friend”—Simon & Garfunkel couldn’t have said it better when it comes to describing ideal conditions for APTs. New targeted attacks against banks in Russia, Armenia, and Malaysia have been detected and attributed to the Silence group. Silence represents an ongoing cybercrime shift from targeting end users (bank account fraud) to carrying out advanced direct attacks against the banks themselves. According to Web India, Silence joins the ranks of the most devastating and complex cyber-robbery operations like Metel, GCMAN, and Carbanak, which succeeded in stealing millions of dollars from financial organizations.
Attacks on banks’ SWIFT wire transfer systems in 2016 made headlines, with the Bank of Bangladesh’s $81 million heist leading the losses. There might be another wave of fraud attacks underway, with news of NIC Asia Bank, one of Nepal’s largest private-sector commercial banks, experiencing an attack between October 17 and October 21. Attackers extracted $4.4 million in fraudulent money transfers from NIC Asia Bank to accounts in six other countries through a compromise of NIC systems. Earlier in October, attackers also stole $60 million from Far Eastern International Bank in Taiwan via fraudulent SWIFT money-moving messages. According to several reports from the past year, these attacks may be attributable to the Lazarus Group which has been very active in The Far East and Africa over the past decade. The group utilizes sophisticated TTPs, tailor-made to compromise SWIFT systems.
As Illusive’s R&D leader, it’s part of my job to be out front understanding the needs of our customers and the broader market. We’re always polling the market to understand what additional pain points deception technology can address. Conversations with our financial services customers this past year turned over a need we hadn’t expected: Can you protect my mainframes?
In 2016, the wire transfer fraud attack on Bangladesh Bank commanded huge headlines and resulted in cyber criminals stealing a whopping $81 million. It could have been worse; the massive “take” was interrupted not by IT security technologies, but by human vigilance. A watchful employee saw a spelling error in a transfer message and alerted an investigation team.