New evidence links the NK Lazarus Group to SWIFT banking attacks

The Analysis of SWIFT attacks revealed five additional pieces of malware containing portions of code shared by Lazarus Group.

While security experts continue to investigate the cyber heists that involved SWIFT systems, new evidence collected by a senior security researcher from Anomali Labs link the malware to the North Korean hacker crew known as Lazarus Group.

The expert discovered that five additional strains of malware suggest the involvement of the Lazarus Group in the cyber attacks that targeted the banks.

Experts at Symantec already linked the malware used in the attack with North Korea.

The researchers at Symantec discovered that the hacking tools used by the gang share many similarities with the malicious code in the arsenal of the Lazarus APT.

The activity of the Lazarus Group surged in 2014 and 2015, its members used mostly custom-tailored malware in their attacks and experts that investigated on the crew consider it highly sophisticated.

“Symantec has found evidence that a bank in the Philippines has also been attacked by the group that stole US$81 million from the Bangladesh central bank and attempted to steal over $1 million from the Tien Phong Bank in Vietnam.” reads the analysis published by Symantec.

The experts at Symantec have spotted at least three strains of malware, Backdoor.Fimlis, Backdoor.Fimlis.B, and Backdoor.Contopee, which have been used in targeted attacks against financial institutions.

“Symantec has identified three pieces of malware which were being used in limited targeted attacks against the financial industry in South-East Asia: Backdoor.Fimlis, Backdoor.Fimlis.B, and Backdoor.Contopee.” states Symantec”At first, it was unclear what the motivation behind these attacks werehowever code sharing between Trojan.Banswift (used in the Bangladesh attack used to manipulate SWIFT transactions) and early variants of Backdoor.Contopee provided a connection.”

Now Aaron Shelmire from Anomali Labs supports this thesis with his investigation.

“Five new additional pieces of malware code discovered that contain unique portions of code related to the SWIFT attacks. ” wrote Shelmire.

The Anomali Labs team conducted deeper research into a very large malware data repository using a set of Yara signature below to search for the shared subroutines.

The experts discovered five additional pieces of malware containing portions of code shared by Lazarus Group’s strains of malware, including the one used in the several SWIFT attacks, according to Shelmire.

“At first, we believed it would produce a lot of false positives. Instead, this search not only failed to result in any false positives, but also turned up five other pieces of malware which share this code. We see this as a possible attribution of the Lazarus group attacks to other attacks that involved these same five pieces of malware code.” states Shelmire.

These portions of code discovered by Shelmire are also present in other malware used in past attacks conducted by North Korean entities against organizations worldwide, including Sony Pictures.


The researchers from the Anomali Labs started by taking a look at the two subroutines that are reported to be unique by Symantec. They get the API names and used it in the Yara signature, then they analyzed the code used in the attacks and discovered a small portion of code where a file name consisting of randomly generated lowercase letters is created, so they used also this string as part of the Yara search criteria.

“Using this criteria, we began a search of a large malware database starting on Thursday night. On Friday morning, we thought we’d be faced with a sea of false positives. But it only returned 10 matches! Four of those were known samples of the SWIFT malware, and one sample was a zip file that includes a known SWIFT sample. The other five samples are detailed above.”

Summarizing, SWIFT hackers have recycled malware code used in past attacks, including the Sony Hack, and evidence suggest the involvement of the Lazarus group

If you appreciate my effort in spreading cyber security awareness, please vote for Security Affairs as best European Security Blog. Vote SecurityAffairs in every section it is reported. I’m one of the finalists and I want to demonstrate that the Security Affairs community a great reality.

Thank you


[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – SWIFT malware, Lazarus group)


Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

Turla APT used two new backdoors to infiltrate a European ministry of foreign affairs

Russia-linked Turla APT allegedly used two new backdoors, named Lunar malware and LunarMail, to target…

6 hours ago

City of Wichita disclosed a data breach after the recent ransomware attack

The City of Wichita disclosed a data breach after the ransomware attack that hit the…

15 hours ago

CISA adds D-Link DIR router flaws to its Known Exploited Vulnerabilities catalog

CISA adds two D-Link DIR-600 and DIR-605 router vulnerabilities to its Known Exploited Vulnerabilities catalog. The…

18 hours ago

CISA adds Google Chrome zero-days to its Known Exploited Vulnerabilities catalog

CISA adds two Chrome zero-day vulnerabilities to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity…

19 hours ago

North Korea-linked Kimsuky APT attack targets victims via Messenger

North Korea-linked Kimsuky APT group employs rogue Facebook accounts to target victims via Messenger and deliver malware.…

21 hours ago

Electronic prescription provider MediSecure impacted by a ransomware attack

Electronic prescription provider MediSecure in Australia suffered a ransomware attack likely originate from a third-party…

1 day ago

This website uses cookies.