Another Bank Hit By Malware – Linked to Bangladesh Bank Heist and Sony Hack

Security researchers from BAE systems who have been investigating the Bangladesh bank heist released a report today saying that the malware used in the bank theft could be linked to other attacks, including the one against Sony Pictures in 2014. While SWIFT hasn't shared the details of which commercial bank was the target of this second heist, BAE said in the report that a commercial bank in Vietnam appears to have been targeted in a similar fashion to the Bangladesh bank theft since the malware is based on a common code-base.

In the latest warning, SWIFT has also pointed that the bank employees may have handed over credentials and other key details to the criminals since the core messaging system of SWIFT wasn't breached in both these attacks. In both attacks, criminals had clear understanding of the different transfer validation methods used by the individual banks. In Bangladesh heist, they tailored their malware to interfere with the printer to validate transfers, while the latest attack used PDF malware to remove traces. The NYT reports that "the criminals attacked the banks’ connections to the SWIFT network," which points out to possible insider hand in the heists.

The attackers clearly exhibit a deep and sophisticated knowledge of specific operation controls within the targeted banks — knowledge that may have been gained from malicious insiders or cyberattacks, or a combination of both.

Since banks are responsible for maintaining the security of their connection to SWIFT, the company has asked its clients to "urgently review controls in their payments environments." If the hackers used bank employees to gain information or had access to banks' networks long enough to learn the system, it will be troublesome for other banks since many may already be compromised.