CSIS entry 817 · August 2018
North Korean hackers stole $13.5 million from India’s Cosmos Bank after breaking into the bank’s system and authorizing thousands of unauthorized ATM withdrawals, as well as several illegal money transfers through the SWIFT financial network.
Reported theft of 13M USD through attack on Cosmos Bank through simultaneous ATM withdrawals across 23 · Aug 2018
Annex 21: Suspected DPRK cyber-attacks on financial institutions (including banks and cryptocurrency exchanges) investigated by the Panel. A. Banks. Reported theft of 13M USD through attack on Cosmos Bank through simultaneous ATM withdrawals across 23 countries in five hours as well as the transfer of 139 million Rupees to a Hong Kong-based company's account in three unauthorized SWIFT transactions. On 8 October 2018 the United States included this and other similar DPRK attacks in its alert regarding the "FASTCash Campaign"
Reported theft of 13M USD · Aug 2018
Annex 21: Suspected DPRK cyber-attacks on financial institutions (including banks and cryptocurrency exchanges) investigated by the Panel. B. Cryptocurrency. Reported theft of 13M USD
N.Korean cyberattack looted $13.5m from Indian bank: UN · 2019-03-29
attribution sentence(s): United Nations: Starved for foreign funds due to UN sanctions, North Korea carried out a $13.5 million (Dh cyber heist of Cosmos Bank using a network across 28 countries by breaking its internal safety measures, according to the world body. | The Security Council’s panel of experts that monitors the sanctions on North Korea said the cyberattack in August last year was carried out “by an advanced persistent threat group” from that country. | Outlining the North Korean tactic, it said, “Not only were the actors able to compromise the SWIFT network in the Cosmos case to transfer the funds to other accounts, but they simultaneously compromised internal bank processes to bypass transaction verification procedures and order worldwide transfers to almost 30 countries where funds were physically withdrawn by individuals in more than 10,000 separate transactions over a weekend.”
Cosmos Bank · August 2018
Para 113: “Then, in August 2018, about $13.5 million was withdrawn from Cosmos Bank in India in more than 14,000 simultaneous automatic teller machine (ATM) withdrawals in 28 countries as well as in additional transfers to an account belonging to a Hong Kong-based company using SWIFT. On 2 October 2018, the United States responded to these ATM withdrawal attacks by issuing a “FASTCash Campaign” alert for the Democratic People’s Republic of Korea.”