MikeLigalig.com

Hackers Stalked Bangladesh Bank for Two Weeks Before Big Heist

by Arun Devnath 
Michael Riley
MichaelRileyDC
March 19, 2016

-Interim investigation report doesn't name possible suspects
-Attackers logged in for short periods from Jan. 24 to Feb. 6

Hackers who stole $101 million from Bangladesh’s central bank stalked its computer systems for almost two weeks beforehand, according to an interim investigation report seen by Bloomberg.

Prepared for Bangladesh Bank by cyber security firms FireEye Inc. and World Informatix, the assessment offers a tantalizing glimpse into how cyber criminals can use banks’ own systems against them. The cyber companies say the thieves deployed malware on servers housed at the central bank to make payments seem genuine.

The report cast the unidentified hackers as a sophisticated group who sought to cover their tracks by deleting computer logs as they went. Before making transfers they sneaked through the network, inserting software that would allow re-entry.

Linkback: https://tubagbohol.mikeligalig.com/index.php?topic=82058.0

Fed Accounts

The hackers sent $81 million from Bangladesh Bank’s account in New York to the Philippines, and another $20 million to Sri Lanka. The Federal Reserve Bank of New York blocked transactions worth another $850 million. A bank in Sri Lanka stopped and returned the cash, while the money in the Philippines is still missing, leading to a Senate probe that is riveting the nation.

"Malware was specifically designed for a targeted attack on Bangladesh Bank to operate on SWIFT Alliance Access servers," the interim report said. Those servers are operated by the bank but run the SWIFT interface, and the report makes it clear the breach stretches into other parts of the bank’s network as well. "The security breach of the SWIFT environment is part of a much larger breach that is currently under investigation."

Linkback: https://tubagbohol.mikeligalig.com/index.php?topic=82058.0

Brief Log-Ins

Patrick Neighorn, a spokesman for FireEye, declined to comment on the report or the investigation. An e-mail to Rakesh Asthana, managing director of World Informatix, wasn’t immediately returned. A call to the company’s office wasn’t answered. Subhankar Saha, spokesman for Bangladesh Bank, said he’s not aware of the report.

The assessment found the first suspicious log-in came on Jan. 24 and lasted less than a minute. On Jan. 29, attackers installed “SysMon in SWIFTLIVE" in what was interpreted as reconnaissance activity, and appeared to operate exclusively with “local administrator accounts.”

Linkback: https://tubagbohol.mikeligalig.com/index.php?topic=82058.0