US blames North Korea for the $81 million Bangladesh cyber heist

US federal prosecutors speculate the involvement of North Korea in the cyber heist of $81 million from Bangladesh’s account at the New York Federal Reserve Bank.

The news was reported by The Wall Street Journal, prosecutors suspect the involvement of Chinese middlemen who helped the Government of Pyongyang to organize the cyber theft.

In February 2016, unknown hackers transferred the funds from the Bangladesh’s account at the New York Federal Reserve Bank to accounts in the Philippines through the SWIFT system.

In reality, the hackers attemted to steal much more, they tried to complete dozens of transfers for an overall amount of $850 million.

The disaster was avoided by accident because the bank’s security systems and typos in some requests allowed the identification of the theft attempts, investigators discovered that hackers failed 35 transfer attempts.

“$81 million was transferred from the Federal Reserve Bank to Filipino accounts while attempts to claim $850 million were foiled by the Federal Reserve Bank’s security system,” Razee Hassan, deputy governor of Bangladesh Bank, told AFP.

“Attempts to transfer money to Sri Lanka by the hackers were foiled as their transfer requests contained typos,” he added.

The hackers exploited gaps in communication between banks at weekends, the operation started on a Friday because the Bangladesh Bank is closed, on the following days, Saturday and Sunday, the Fed Bank in New York was being closed.

The choice of the Philippines as the landing country for the bank transfers was not casual, banks were also closed on the Monday due to the Chinese New Year.

A top police investigator in Dhaka told Reuters in December that some Bangladesh Bank officials deliberately exposed its computer systems allowing hackers to penetrate the systems.

The Justice Department and the New York Fed declined to comment on the report.

The suspect of the involvement of the North Korea behind the cyber heist is not a novelty

“The U.S. Federal Bureau of Investigation believes that North Korea is responsible for the heist, an official briefed on the probe told Reuters. Richard Ledgett, deputy director of the U.S. National Security Agency, publicly suggested on Tuesday that North Korea may be linked to the incident, while private firms have long pointed the finger at the reclusive state.” reported the Reuters Agency.

Security experts at Symantec linked the attacks against banks worldwide to the Lazarus APT group which is believed to be a nation state actor.

In June 2016, evidence collected by a senior security researcher from Anomali Labs linked the malware to the North Korean hacker crew known as Lazarus Group.

The expert discovered that five additional strains of malware that suggested the involvement of the Lazarus Group in the cyber attacks that targeted the banks.

The researchers at Symantec discovered that the hacking tools used by the gang share many similarities with the malicious code in the arsenal of the Lazarus APT.

The activity of the Lazarus Group surged in 2014 and 2015, its members used mostly custom-tailored malware in their attacks and experts that investigated on the crew consider it highly sophisticated.

“Symantec has found evidence that a bank in the Philippines has also been attacked by the group that stole US$81 million from the Bangladesh central bank and attempted to steal over $1 million from the Tien Phong Bank in Vietnam.” reads the analysis published by Symantec last year.

The experts at Symantec have spotted at least three strains of malware, Backdoor.Fimlis, Backdoor.Fimlis.B, and Backdoor.Contopee, which have been used in targeted attacks against financial institutions.

“Symantec has identified three pieces of malware which were being used in limited targeted attacks against the financial industry in South-East Asia: Backdoor.Fimlis, Backdoor.Fimlis.B, and Backdoor.Contopee.” states Symantec”At first, it was unclear what the motivation behind these attacks were, however code sharing between Trojan.Banswift (used in the Bangladesh attack used to manipulate SWIFT transactions) and early variants of Backdoor.Contopee provided a connection.”

The expert Aaron Shelmire from Anomali Labs supported this thesis with his investigation.

“Five new additional pieces of malware code discovered that contain unique portions of code related to the SWIFT attacks. ” wrote Shelmire.

The Anomali Labs team conducted deeper research into a very large malware data repository using a set of Yara signature below to search for the shared subroutines.

The experts discovered five additional pieces of malware containing portions of code shared by Lazarus Group’s strains of malware, including the one used in the several SWIFT attacks, according to Shelmire.

Last week, SWIFT announced it planned to cut off the remaining North Korean banks still connected to its system as concerns about the North Korean nuclear program and missile tests conducted by Pyongyang.

The U.S. Treasury is considering sanctions against the alleged Chinese middlemen who facilitated the cyber heist.

The New York Fed and SWIFT declined to comment.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – Bangladesh cyber heist, security breach)

[adrotate banner=”5″]

[adrotate banner=”13″]