Cyber-security firm Symantec Corp. said on Tuesday that a second hacking group has sought to rob banks using fraudulent SWIFT messages, the same approach that yielded $81-million in the high-profile February attack on Bangladesh’s central bank.

Symantec said that a group dubbed Odinaff has infected 10 to 20 organizations with malware that can be used to hide fraudulent transfer requests made over SWIFT, the messaging system that is a lynchpin of the global financial system.

Symantec’s research provided new insight into ongoing hacking that has previously been disclosed by SWIFT. SWIFT chief executive Gottfried Leibbrandt last month told customers about three hacks and warned that cyber attacks on banks are poised to rise.

SWIFT and Symantec have not identified specific victims beyond Bangladesh Bank. Symantec said that most Odinaff attacks occurred in the United States, Hong Kong, Australia, the United Kingdom and Ukraine.

Symantec said it would share technical information about Odinaff with banks, governments and other security firms.

The company in May said it believed the Bangladesh heist was carried out by a group known as Lazarus, which was also responsible for attacks on SWIFT customers in Southeast Asia as well as the 2014 hack of Sony Pictures Entertainment.

Symantec researcher Eric Chien said his firm has not confirmed that North Korea was behind Lazarus, but that the high level of sophistication of its work suggests involvement by not a nation state, he added.

Symantec said it believed that Odinaff is linked to Carbanak, a hacking group that has been targeting banks and merchant point-of-sale systems since at least 2014. </s> Cybersecurity giant Symantec Corp. (SYMC) announced Tuesday that a second hacking group has launched a mission to rob banks using fraudulent messages on the financial messaging platform SWIFT, reports Reuters. The group, dubbed “Odinaff,” has used the same approach that yielded $81 million from an attack earlier this year on the central bank of Bangladesh. (See also: Investors Rally to Cybersecurity.)

Using Malware to Hack SWIFT

The Mountain View, Calif.-based company said the new hackers have infected 10 to 20 of its customers with malware that can be used to hide fraudulent transfer request on SWIFT, a financial messaging service used globally by moe than 11,000 financial institutions in more than 200 countries and territories.

Last Month, SWIFT CEO Gottfried Leibbrandt disclosed information on three hacks and warned of an upcoming surge in cyberattacks on banks. SWIFT and Symantec have not given details to the public about targets beyond the Bangladesh Bank, but they point to the United States, Hong Kong, Australia, the United Kingdom and Ukraine as major hubs for Odinaff attacks.

Banks Become Cybercrime Targets

The news indicates a surge in recent cybercrime, particularly in the financial sector, and a subsequent, revitalized need for next-gen cybersecurity. While Lazarus—the hacker group allegedly behind the Bangladesh heist and the 2014 hack of Sony Pictures Entertainment—has been linked to North Korea, Odinaff appears to be a financially motivated criminal group unaffiliated with a nation state.

“The discovery of Odinaff indicates that banks are at a growing risk of attack. Over the past few years, cybercriminals have begun to display a deep understanding of the internal financial systems used by banks. They have learned that banks employ a diverse range of systems and have invested time in finding out how they work and how employees operate them. When coupled with the high level of technical expertise available to some groups, these groups now pose a significant threat to any organization they target,” Symantec stated in a company release on Tuesday. (See also: Cybercrime Pays for Tech Investors.) </s> (Reuters) - Cyber-security firm Symantec Corp said on Tuesday that a second hacking group has sought to rob banks using fraudulent SWIFT messages, the same approach that yielded $81 million in the high-profile February attack on Bangladesh’s central bank.

Swift code bank logo is displayed on an iPhone 6s on top of Euro banknotes in this picture illustration, January 26, 2016. REUTERS/Dado Ruvic/Illustration/File Photo

Symantec said that a group dubbed Odinaff has infected 10 to 20 organizations with malware that can be used to hide fraudulent transfer requests made over SWIFT, the messaging system that is a lynchpin of the global financial system.

Symantec’s research provided new insight into ongoing hacking that has previously been disclosed by SWIFT. SWIFT Chief Executive Gottfried Leibbrandt last month told customers about three hacks and warned that cyber attacks on banks are poised to rise.

SWIFT and Symantec have not identified specific victims beyond Bangladesh Bank. Symantec said that most Odinaff attacks occurred in the United States, Hong Kong, Australia, the United Kingdom and Ukraine.

Symantec said it would share technical information about Odinaff with banks, governments and other security firms.

The company in May said it believed the Bangladesh heist was carried out by a group known as Lazarus, which was also responsible for attacks on SWIFT customers in Southeast Asia as well as the 2014 hack of Sony Pictures Entertainment.

The U.S. government has blamed North Korea for the Sony attack.

Symantec researcher Eric Chien said his firm has not confirmed that North Korea was behind Lazarus, but that the high level of sophistication of its work suggests involvement by a nation state.

Odinaff, on the other hand, appears to be a financially motivated criminal group, not a nation state, he added.

SWIFT spokeswoman Natasha de Terán said that the messaging cooperative’s customer security intelligence team had sent a warning about Odinaff’s activities to its members in the early summer.

That warning included technical indicators to help thwart potential attacks and a description of the group’s habits, Terán said.

Symantec said it believed that Odinaff is linked to Carbanak, a hacking group that has been targeting banks and merchant point-of-sale systems since at least 2014.

The two groups employ similar tactics in carrying out attacks and have used the same IP addresses to connect to their servers, according to Symantec.

(This version of the story corrects to make clear that 10 to 20 organizations were infected with Odinaff and not all of them were Symantec customers in the second paragraph) </s> Symantec said that a group dubbed Odinaff has infected 10 to 20 organizations with malware that can be used to hide fraudulent transfer requests made over SWIFT, the messaging system that is a lynchpin of the global financial system.

Symantec's research provided new insight into ongoing hacking that has previously been disclosed by SWIFT. SWIFT Chief Executive Gottfried Leibbrandt last month told customers about three hacks and warned that cyber attacks on banks are poised to rise.

SWIFT and Symantec have not identified specific victims beyond Bangladesh Bank. Symantec said that most Odinaff attacks occurred in the United States, Hong Kong, Australia, the United Kingdom and Ukraine.

Symantec said it would share technical information about Odinaff with banks, governments and other security firms.

The company in May said it believed the Bangladesh heist was carried out by a group known as Lazarus, which was also responsible for attacks on SWIFT customers in Southeast Asia as well as the 2014 hack of Sony Pictures Entertainment.

The U.S. government has blamed North Korea for the Sony attack.

Symantec researcher Eric Chien said his firm has not confirmed that North Korea was behind Lazarus, but that the high level of sophistication of its work suggests involvement by a nation state.

Odinaff, on the other hand, appears to be a financially motivated criminal group, not a nation state, he added.

SWIFT spokeswoman Natasha de Terán said that the messaging cooperative's customer security intelligence team had sent a warning about Odinaff's activities to its members in the early summer.

That warning included technical indicators to help thwart potential attacks and a description of the group's habits, Terán said.

Symantec said it believed that Odinaff is linked to Carbanak, a hacking group that has been targeting banks and merchant point-of-sale systems since at least 2014.

The two groups employ similar tactics in carrying out attacks and have used the same IP addresses to connect to their servers, according to Symantec. </s> Hackers in 2016 stole 2 billion rubles -- equivalent to $31 million -- from accounts that banks keep at Russia's central bank.

The Bank of Russia confirmed the cyberattacks and the extent of the losses to CNNMoney on Friday.

Hackers had tried to steal 5 billion rubles, but the central banking authority managed to stop them and redirect the funds, according to central bank security executive Artiom Sychev.

"We were lucky to return some of money," said a central bank spokesperson.

The hackers targeted commercial banks, but they also stole cash from their clients, the central bank reported.

The central bank did not say when the cyberheists occurred, but said they took place over 2016. They also did not say how hackers moved the funds. But so far, the attack bears some similarity to a recent string of heists that has targeted the worldwide financial system.

In January 2015, hackers got a hold of an Ecuadorian bank's codes for using SWIFT, the worldwide interbank communication network that settles transactions. They used Banco del Austro's credentials to steal money the bank kept at Wells Fargo.

In October, hackers used the same technique to slip into a bank in the Philippines.

Two months later, hackers tried to make fraudulent requests at a commercial bank in Vietnam. They were stopped.

This past February, computer hackers stole $101 million from Bangladesh's central bank -- also by gaining access to SWIFT. That time, the bank robbers made five transfers out of Bangladesh Bank's account at the Federal Reserve Bank of New York. The hackers tried to steal $951 million, but the Fed cut them off before the completion of the theft.

Researchers at the cybersecurity firm Symantec have concluded that the global banking system has been under sustained attack from a sophisticated group -- dubbed "Lazarus" -- that has been linked to North Korea.

But it's unclear who has attacked Russian banks this time around.

Earlier Friday, the Russian government claimed it had foiled an attempt to erode public confidence in its financial system.

Russian's top law enforcement agency, the FSB, said hackers were planning to use a collection of computer servers in the Netherlands to attack Russian banks. Typically, hackers use this kind of infrastructure to launch a "denial of service" attack, which disrupts websites and business operations by flooding a target with data.

The FSB said hackers also planned to spread fake news about Russian banks, sending mass text messages and publishing stories on social media questioning their financial stability and licenses to operate.

Editors note: This story has been updated to clarify that the losses cited from cyberattacks at Russia's central bank were for 2016, not a single attack. </s> A padlock is displayed at the Alert Logic booth during the 2016 Black Hat cyber-security conference in Las Vegas, Nevada, U.S. August 3, 2016. REUTERS/David Becker

MOSCOW (Reuters) - Hackers stole more than 2 billion rubles ($31 million) from correspondent accounts at the Russian central bank, the bank said on Friday, the latest example of an escalation of cyber attacks on financial institutions around the globe.

Central bank official Artyom Sychyov discussed the losses at a briefing, saying that the hackers had attempted to steal about 5 billion rubles.

Sychyov was commenting on a central bank report released earlier in the day, that told about hackers breaking into accounts there by faking a client's credentials. The bank provided few other details in its lengthy report.

Financial regulators around the world have recently urged banks to beef up cyber security in the wake of a string of high-profile heists on banks around the world.

Fears about attacks on banks have mounted since February when unknown cyber criminals stole $81 million in funds that Bangladesh's central bank had on deposit at the New York Fed. Law enforcement agencies around the globe are hunting for the criminals who stole the money using fraudulent wire-transfer requests sent over the SWIFT bank messaging network.

Separately, Russia said on Friday that it had uncovered a plot by foreign spy agencies to sow chaos in the country's banking system via a coordinated wave of cyber attacks and fake social media reports about banks going bust. </s> A padlock is displayed at the Alert Logic booth during the 2016 Black Hat cyber-security conference in Las Vegas, Nevada, U.S. August 3, 2016. REUTERS/David Becker

MOSCOW (Reuters) - (This December 2 story corrects to show the 2 billion rubles is combined amount stolen from accounts in central bank and commercial banks, not from central bank alone; clarifies that the figures are total stolen in cyberattacks for the year to date)

Hackers stole more than 2 billion rubles ($31 million) from correspondent accounts at the Russian central bank and from accounts in commercial banks, the bank said on Friday, the latest example of an escalation of cyber attacks on financial institutions around the globe.

Central bank official Artyom Sychyov discussed the losses at a briefing, saying that the hackers had attempted to steal about 5 billion rubles. He said the figures were the totals recorded stolen, or the target of attempted theft, in cyber attacks over the course of 2016.

Sychyov was commenting on a central bank report released earlier in the day, that told of hackers breaking into accounts there by faking a client’s credentials. The bank provided few other details in its lengthy report.

Financial regulators around the world have recently urged banks to beef up cyber security in the wake of a string of high-profile heists on banks around the world.

Fears about attacks on banks have mounted since February when unknown cyber criminals stole $81 million in funds that Bangladesh’s central bank had on deposit at the New York Fed. Law enforcement agencies around the globe are hunting for the criminals who stole the money using fraudulent wire-transfer requests sent over the SWIFT bank messaging network.

Separately, Russia said on Friday that it had uncovered a plot by foreign spy agencies to sow chaos in the country’s banking system via a coordinated wave of cyber attacks and fake social media reports about banks going bust.

($1 = 63.8300 rubles) </s> (Reuters) - Hackers released documents and files on Friday that cybersecurity experts said indicated the U.S. National Security Agency had accessed the SWIFT interbank messaging system, allowing it to monitor money flows among some Middle Eastern and Latin American banks.

FILE PHOTO: Swift code bank logo is displayed on an iPhone 6s among Euro banknotes in this picture illustration January 26, 2016. REUTERS/Dado Ruvic/File Photo - RTS11WHG

The release included computer code that could be adapted by criminals to break into SWIFT servers and monitor messaging activity, said Shane Shook, a cyber security consultant who has helped banks investigate breaches of their SWIFT systems.

The documents and files were released by a group calling themselves The Shadow Brokers. Some of the records bear NSA seals, but Reuters could not confirm their authenticity.

The NSA could not immediately be reached for comment.

Also published were many programs for attacking various versions of the Windows operating system, at least some of which still work, researchers said.

In a statement to Reuters, Microsoft (MSFT.O), maker of Windows, said it had not been warned by any part of the U.S. government that such files existed or had been stolen.

“Other than reporters, no individual or organization has contacted us in relation to the materials released by Shadow Brokers,” the company said.

The absence of warning is significant because the NSA knew for months about the Shadow Brokers breach, officials previously told Reuters. Under a White House process established by former President Barack Obama’s staff, companies were usually warned about dangerous flaws.

Shook said criminal hackers could use the information released on Friday to hack into banks and steal money in operations mimicking a heist last year of $81 million from the Bangladesh central bank.

“The release of these capabilities could enable fraud like we saw at Bangladesh Bank,” Shook said.

The SWIFT messaging system is used by banks to transfer trillions of dollars each day. Belgium-based SWIFT downplayed the risk of attacks employing the code released by hackers on Friday.

SWIFT said it regularly releases security updates and instructs client banks on how to handle known threats.

“We mandate that all customers apply the security updates within specified times,” SWIFT said in a statement.

SWIFT said it had no evidence that the main SWIFT network had ever been accessed without authorization.

It was possible that the local messaging systems of some SWIFT client banks had been breached, SWIFT said in a statement, which did not specifically mention the NSA.

When cyberthieves robbed the Bangladesh Bank last year, they compromised that bank’s local SWIFT network to order money transfers from its account at the New York Federal Reserve.

The documents released by the Shadow Brokers on Friday indicate that the NSA may have accessed the SWIFT network through service bureaus. SWIFT service bureaus are companies that provide an access point to the SWIFT system for the network’s smaller clients and may send or receive messages regarding money transfers on their behalf.

“If you hack the service bureau, it means that you also have access to all of their clients, all of the banks,” said Matt Suiche, founder of the United Arab Emirates-based cybersecurity firm Comae Technologies, who has studied the Shadow Broker releases and believes the group has access to NSA files.

The documents posted by the Shadow Brokers include Excel files listing computers on a service bureau network, user names, passwords and other data, Suiche said.

“That’s information you can only get if you compromise the system,” he said.

ATTEMPT TO MONITOR FLOW OF MONEY

Cris Thomas, a prominent security researcher with the cybersecurity firm Tenable, said the documents and files released by the Shadow Brokers show “the NSA has been able to compromise SWIFT banking systems, presumably as a way to monitor, if not disrupt, financial transactions to terrorists groups”.

Since the early 1990s, interrupting the flow of money from Saudi Arabia, the United Arab Emirates and elsewhere to al Qaeda, the Taliban, and other militant Islamic groups in Afghanistan, Pakistan and other countries has been a major objective of U.S. and allied intelligence agencies.

Mustafa Al-Bassam, a computer science researcher at University College London, said on Twitter that the Shadow Brokers documents show that the “NSA hacked a bunch of banks, oil and investment companies in Palestine, UAE, Kuwait, Qatar, Yemen, more.”

He added that NSA “completely hacked” EastNets, one of two SWIFT service bureaus named in the documents that were released by the Shadow Brokers.

Reuters could not independently confirm that EastNets had been hacked.

EastNets, based in Dubai, denied it had been hacked in a statement, calling the assertion “totally false and unfounded.”

EastNets ran a “complete check of its servers and found no hacker compromise or any vulnerabilities,” according to a statement from EastNets’ chief executive and founder, Hazem Mulhim.

In 2013, documents released by former NSA contractor Edward Snowden said the NSA had been able to monitor SWIFT messages.

The agency monitored the system to spot payments intended to finance crimes, according to the documents released by Snowden.

Reuters could not confirm whether the documents released Friday by the Shadow Brokers, if authentic, were related to NSA monitoring of SWIFT transfers since 2013.

Some of the documents released by the Shadow Brokers were dated 2013, but others were not dated.

The documents released by the hackers did not clearly indicate whether the NSA had actually used all the techniques cited for monitoring SWIFT messages. </s> POLICE HAVE NICKED the suspected leader of a group of cyber crooks that managed to pilfer up to €1bn, some £873m, from banks over the past few years.

The suspect was cornered and arrested by Spanish police in Spain's port city of Alicante, and is beehived to be the head of the cyber criminal gang behind the Carbanak and Cobalt malware attacks which targeted more than 100 financial institutions worldwide since 2013. 

 

"The criminal operation has struck banks in more than 40 countries and has resulted in cumulative losses of over €1bn for the financial industry. The magnitude of the losses is significant: the Cobalt malware alone allowed criminals to steal up to €10m per heist," said Europol, which worked with the Spanish National Police, the FBI, Romanian, Belarussian and Taiwanese authorities, as well as private cyber security firms, all to nab the cyber crook.

The cyber criminal gang started out its heavy hitting heists with the Anunak malware campaign that saw it steal $81m from the Bangladesh Bank. That cyber heist then led to the Carbanak attacks which saw more than $300m swiped from banks, and then the Cobalt attacks which targeted banks in at least 14 countries and saw ATMs spit out cash.

Through the use of phishing emails, the hackers would encourage unsuspecting bank workers to download malicious attachments and end up infecting their machines. And from there the hackers could spread their malware and go hunting for money.

But now that the so-called "mastermind" behind the hacking group has been captured and arrested, it looks like the future of the cyber heist outfit could be at risk; we've all seen Ocean's Eleven and know that a good leader is the crux of a successful heist, apparently.

In this case, the as-yet-unnamed leader was responsible for developing the malware, so without him, the cyber criminal group may have lost the brains of its operation.

"This global operation is a significant success for international police cooperation against a top level cybercriminal organisation. The arrest of the key figure in this crime group illustrates that cybercriminals can no longer hide behind perceived international anonymity," said Steven Wilson, head of Europol's European Cybercrime Centre.

"This is another example where the close cooperation between law enforcement agencies on a worldwide scale and trusted private sector partners is having a major impact on top level cyber criminality."

We'll have to wait and see if the cyber criminal group is on its last legs, but it would appear that if you're going to try and pilfer cash from a bank by using malware, a whole roster of law enforcement will be coming after you. µ
Computer security firm Symantec warns a second hacking group, going by the name Odinaff, is trying to rob banks using fraudulent SWIFT messages, the same approach that yielded U.S.$81 million in February's attack on Bangladesh's central bank. So far, the group has infected 10 to 20 organizations with this malware.