DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

Banco de Chile

Date (as written)
2018-05
Year
2018
Country
Chile
Actors (as written)
Bluenoroff
Actor pages
Bluenoroff
Tags (as written)
Finance FinancialGain SWIFT
Dollar figures (as written)
$10 million; 10 million USD

Source entries (6)

lazarus.day

Banco de Chile · 2018-05
Banco de Chile is tracked as a May 2018 Chilean financial-sector and SWIFT-related incident across financial-hack trend reporting and the UN Panel of Experts’ DPRK sanctions-evasion reporting. The linked UN evidence frames the wider set of bank and exchange thefts as DPRK cyber activity used to launder proceeds and generate revenue under Reconnaissance General Bureau direction, but the provided excerpts do not expose Banco de Chile-specific malware, infrastructure, or transaction details.
https://lazarus.day/incidents/bancodechile/

EuRepoC

APT38 attacks Chilean Central Bank · 11.06.2018
Shares in the Bank of Chile (the country's central bank) have fallen after it confirmed that hackers diverted $10 million of its funds, mainly to Hong Kong. However, according to the bank, no customer accounts were affected but 9,000 workstations and 500 servers. Apparently, a wiper malware was used to reveal the true purpose of the attack (compromising endpoints that process transactions over the SWIFT network).
https://threatpost.com/banco-de-chile-wiper-attack-just-a-cover-for-10m-swift-heist/132796/
https://content.fireeye.com/apt/rpt-apt38

UN Panel of Experts S/2019/691

Theft of approximately 10 million USD from Banco de Chile through unauthorized transactions using SWIFT, · May 2018
Annex 21: Suspected DPRK cyber-attacks on financial institutions (including banks and cryptocurrency exchanges) investigated by the Panel. A. Banks. Theft of approximately 10 million USD from Banco de Chile through unauthorized transactions using SWIFT, mainly to Hong Kong. The hackers distracted bank employs from the theft by using malware to render 9000 bank owned computers inoperable.
https://undocs.org/S/2019/691

Mendeley Data: Collection of DPRK state-sponsored threat actors' activities v2 (Lyu, Sungkyunkwan Univ.)

Banco de Chile · 2018-05
Reported: 2018-05; Victims: Banco de Chile; Motivations: FinancialGain; Sectors: Finance; Countries: Chile
https://data.mendeley.com/datasets/wwb2rzgfn7/2

CISA/Treasury/FBI/USCYBERCOM advisory AA20-239A (FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks)

Wiper attack on a bank in Chile during SWIFT fraud (Banco de Chile not named) · 2018
Additionally, in 2018, they deployed wiper malware against a bank in Chile that crashed thousands of computers and servers to distract from efforts to send fraudulent messages from the bank's compromised SWIFT terminal.
https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-239a

UN Panel of Experts S/2019/171

Banco de Chile · May 2018
Para 113: “In May 2018, a Democratic People’s Republic of Korea cyberattack by an advanced persistent threat group resulted in $10 million being transferred from Banco de Chile mainly to accounts in Hong Kong via unauthorized transactions using SWIFT. Using IP addresses and other details published by the United States Department of Justice, open-source technical analysis has linked the perpetrators with Lab 110, which according to the United States is part of the Reconnaissance General Bureau.”
https://undocs.org/S/2019/171

Suggest a correction on GitHub