Union Bank of India

lazarus.day

Union Bank of India appears in UN Panel reporting as part of a wider set of financial-institution and cryptocurrency-exchange incidents used to illustrate DPRK cyber-enabled theft and sanctions-evasion revenue generation. The linked evidence supports only high-level classification as a finance/SWIFT-related DPRK cyber theft case and does not provide victim-specific malware, infrastructure, transaction flow, or intrusion-chain details.

UN Panel of Experts S/2019/691

Annex 21: Suspected DPRK cyber-attacks on financial institutions (including banks and cryptocurrency exchanges) investigated by the Panel. A. Banks. Attempted theft of $166M using tactics and techniques similar to February 2016 attack on Bangladesh Bank. Funds were transferred to the Canadia Bank Plc and RHB IndoChina Bank Ltd in Cambodia, the Siam Commercial Bank in Thailand, Bank Sinopac in Taiwan Province of China, and a bank in Australia (routed by Citibank New York and JP Morgan Chase New York).

Mendeley Data: Collection of DPRK state-sponsored threat actors' activities v2 (Lyu, Sungkyunkwan Univ.)

Reported: 2016-07; Victims: Union Bank of India; Motivations: FinancialGain; Sectors: Finance; Countries: India

Hackmageddon cyber attacks timelines (Paolo Passeri)

North Korean hackers are suspected of attempting to steal $170m from Union Bank of India, back in 2015.

During a reconciliation exercise of the Society for Worldwide Interbank Financial Telecommunication (SWIFT) messages, the bank had found that $171 million was unaccounted for, they said.

The case, which was being probed by the Mumbai Police, pertains to transfer of about Rs 12 bn from the Nostro account of the bank to various countries on July 20, 2016, they said.

July 2016 India Attempted theft of $166M using tactics and techniques similar to February 2016 attack on Bangladesh Bank.