New evidence links the NK Lazarus Group to SWIFT banking attacks

The Analysis of SWIFT attacks revealed five additional pieces of malware containing portions of code shared by Lazarus Group.

While security experts continue to investigate the cyber heists that involved SWIFT systems, new evidence collected by a senior security researcher from Anomali Labs link the malware to the North Korean hacker crew known as Lazarus Group.

The expert discovered that five additional strains of malware suggest the involvement of the Lazarus Group in the cyber attacks that targeted the banks.

Experts at Symantec already linked the malware used in the attack with North Korea.

The researchers at Symantec discovered that the hacking tools used by the gang share many similarities with the malicious code in the arsenal of the Lazarus APT.

The activity of the Lazarus Group surged in 2014 and 2015, its members used mostly custom-tailored malware in their attacks and experts that investigated on the crew consider it highly sophisticated.

“Symantec has found evidence that a bank in the Philippines has also been attacked by the group that stole US$81 million from the Bangladesh central bank and attempted to steal over $1 million from the Tien Phong Bank in Vietnam.” reads the analysis published by Symantec.

The experts at Symantec have spotted at least three strains of malware, Backdoor.Fimlis, Backdoor.Fimlis.B, and Backdoor.Contopee, which have been used in targeted attacks against financial institutions.

“Symantec has identified three pieces of malware which were being used in limited targeted attacks against the financial industry in South-East Asia: Backdoor.Fimlis, Backdoor.Fimlis.B, and Backdoor.Contopee.” states Symantec”At first, it was unclear what the motivation behind these attacks were, however code sharing between Trojan.Banswift (used in the Bangladesh attack used to manipulate SWIFT transactions) and early variants of Backdoor.Contopee provided a connection.”

Now Aaron Shelmire from Anomali Labs supports this thesis with his investigation.

“Five new additional pieces of malware code discovered that contain unique portions of code related to the SWIFT attacks. ” wrote Shelmire.

The Anomali Labs team conducted deeper research into a very large malware data repository using a set of Yara signature below to search for the shared subroutines.

The experts discovered five additional pieces of malware containing portions of code shared by Lazarus Group’s strains of malware, including the one used in the several SWIFT attacks, according to Shelmire.

“At first, we believed it would produce a lot of false positives. Instead, this search not only failed to result in any false positives, but also turned up five other pieces of malware which share this code. We see this as a possible attribution of the Lazarus group attacks to other attacks that involved these same five pieces of malware code.” states Shelmire.

These portions of code discovered by Shelmire are also present in other malware used in past attacks conducted by North Korean entities against organizations worldwide, including Sony Pictures.

 

The researchers from the Anomali Labs started by taking a look at the two subroutines that are reported to be unique by Symantec. They get the API names and used it in the Yara signature, then they analyzed the code used in the attacks and discovered a small portion of code where a file name consisting of randomly generated lowercase letters is created, so they used also this string as part of the Yara search criteria.

“Using this criteria, we began a search of a large malware database starting on Thursday night. On Friday morning, we thought we’d be faced with a sea of false positives. But it only returned 10 matches! Four of those were known samples of the SWIFT malware, and one sample was a zip file that includes a known SWIFT sample. The other five samples are detailed above.”

Summarizing, SWIFT hackers have recycled malware code used in past attacks, including the Sony Hack, and evidence suggest the involvement of the Lazarus group

If you appreciate my effort in spreading cyber security awareness, please vote for Security Affairs as best European Security Blog. Vote SecurityAffairs in every section it is reported. I’m one of the finalists and I want to demonstrate that the Security Affairs community a great reality.

https://www.surveymonkey.com/r/secbloggerwards2016

Thank you

Pierluigi

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – SWIFT malware, Lazarus group)