Bangladesh Central Bank · 2016-02
The Bangladesh Bank BangSwift heist used authenticated SWIFT messages and custom malware tailored to SWIFT Alliance Access and an Oracle database environment to hide or manipulate transaction records, with reporting describing attempted transfers of roughly $951 million and about $101 million stolen. BAE Systems, Symantec, and Anomali connected the SWIFT malware to a wider bank-targeting toolset through shared wiping routines, Trojan.Banswift, Backdoor.Contopee, and Lazarus-associated Operation Blockbuster code overlaps, supporting the existing Bluenoroff attribution for a financially motivated DPRK-linked banking operation.
North Korean State-Sponsored Lazarus Group Steals $81 Million from Bangladesh Central Bank in Cyber Heist on February 2016 · 04.02.2016
In February 2016, the Bangladesh Central Bank fell victim to a major cyber theft that was later almost certainly attributed to the notorious North Korean Lazarus Group. This sophisticated cybercrime, known as the "Bangladesh Central Bank Heist", utilised sophisticated "SWIFT Client" malware. This malware allowed the hackers to penetrate the bank's SWIFT system - a global financial communications network used by more than 11,000 institutions - and issue fraudulent transfer orders. The attack began on 4 February 2016 and targeted the Bangladesh Central Bank's account at the US Federal Reserve Bank. Despite aiming to transfer funds totalling nearly $1 billion, the hackers managed to divert around $81 million to accounts in the Philippines. The operation was undermined by a simple but crucial mistake: a misspelled word in one of the transfer requests that aroused suspicion and led to the transaction being cancelled.
The investigation into the heist, led by US firm FireEye, Mandiant division, and World Informatix Cyber Security, uncovered evidence of malware being installed on the bank's system retrospectively in January 2016. The investigation revealed that the hackers had intimate knowledge of the bank's internal procedures for international payments and wire transfers - making the cyber heist possible.
US prosecutors, the FBI and cybersecurity firms such as Symantec Corp and BAE Systems concluded that the Lazarus Group was behind the heist based on the use of Lazarus-typical TTPs.
Sources cited by EuRepoC (19)
Show 14 more
Bangladesh Central Bank · 2016-03-10
Reuters reports that unknown hackers were able to breach the Bangladesh Bank's systems and steal its credentials for payment transfers, using them to transfer money to entities in the Philippines and Sri Lanka. The hackers were able to get away with about $80 million. The attackers were later revealed to be from North Korea.
Attempted theft of $951M · Feb 2016
Annex 21: Suspected DPRK cyber-attacks on financial institutions (including banks and cryptocurrency exchanges) investigated by the Panel. A. Banks. Attempted theft of $951M
Bangladesh Central Bank · 2016-02
Reported: 2016-02; Victims: Bangladesh Central Bank; Motivations: FinancialGain; Sectors: Finance; Countries: Bangladesh
Bangladesh Bank Heist · February 2016
Bangladesh Bank Heist. In February 2016, DPRK state-sponsored cyber actors allegedly attempted to steal at least $1 billion from financial institutions across the world and allegedly stole $81 million from the Bangladesh Bank through unauthorized transactions on the Society for Worldwide Interbank Financial Telecommunication (SWIFT) network. According to the complaint, DPRK cyber actors accessed the Bangladesh Bank’s computer terminals that interfaced with the SWIFT network after compromising the bank’s computer network via spear phishing emails targeting bank employees. DPRK cyber actors then sent fraudulently authenticated SWIFT messages directing the Federal Reserve Bank of New York to transfer funds out of the Bangladesh Bank’s Federal Reserve account to accounts controlled by the conspirators. DOJ’s Criminal Complaint of a North Korean Regime-Backed Programmer (Sept. 6, 2018) https://www.justice.gov/opa/pr/north-korean-regime-backed-programmer-charged-conspiracy-conduct-multiple-cyber-attacks-and
SWIFT Network Bank Heist · February 2016
$81 million was stolen from Bangladesh Bank, and similar heists on banks in Vietnam and Ecuador were attributed to the same group related to North Korea.
Fraudulent transfer from Bangladesh Bank · February 2016
These same subjects also targeted and then executed the fraudulent transfer of $81 million from Bangladesh Bank, the central bank of Bangladesh, in February 2016 ... and engaged in computer intrusions and cyber-heists at many more financial services victims in the United States, and in other countries in Europe, Asia, Africa, North America, and South America in 2015, 2016, 2017, and 2018, with attempted losses well over $1 billion. [Case No. 2:18-mj-01479, U.S. District Court for the Central District of California; filing: COMPLAINT filed as to Defendant Park Jin Hyok in violation of 18:371; 18:1349. Approved by Magistrate Judge Rozella A. O]
Bangladesh Bank fraudulent wire transfers · On February 4, 2016
Overt Act No. 6: On February 4, 2016, having gained unauthorized access to Bangladesh Bank’s computer network at an earlier date, the hackers attempted to conduct false and fraudulent wire transfers totaling approximately $951 million, and conducted false and fraudulent wire transfers totaling approximately $81 million to bank accounts in the Philippines and $20 million to a bank account in Sri Lanka, which moneys all belonged to Bangladesh Bank and were held in accounts at the Federal Reserve Bank of New York. [Case No. 2:20-cr-00614, U.S. District Court for the Central District of California; filing: SEALED INDICTMENT filed as to Jon Chang Hyok]
Theft from Bangladesh Bank's account at the Federal Reserve Bank of New York (Bangladesh Bank v. RCBC et al., civil RICO complaint) · On February 4, 2016
On February 4, 2016, thieves reached into a bank account at the Federal Reserve Bank of New York ("New York Fed") and stole approximately $101 million (out of the nearly $1 billion they attempted to steal). The conspirators included North Korean hackers who had already broken into the computer systems of Sony Pictures Entertainment ("Sony"). [Case No. 1:19-cv-00983, U.S. District Court for the Southern District of New York; filing: COMPLAINT against Romualdo S. Agarrado, Michael Bastista, Salud Batista, Bloomberry Resorts and Hotels, Inc. d/b/a Solai]
Bangladesh Bank theft · 2016
Most infamously, the BeagleBoyz stole $81 million from the Bank of Bangladesh in 2016. The Federal Reserve Bank of New York stopped the remainder of this attempted $1 billion theft after detecting anomalies in the transfer instructions they had received.
孟加拉央行8100万美元劫案线索直指朝鲜_电子银行网 · 2017-04-14
attribution sentence(s): 核心提示一系列银行劫案背后的邪恶黑客留下了线索，指向之前就受怀疑的朝鲜。自称Lazarus Group的黑客团伙，被视为一系列银行黑客劫案背后的罪魁祸首，这些劫案包括2016年2月孟加拉央行SWIFT交易软件漏出的8100万美元。 | 黑客团伙Lazarus Group或与2014年索尼影业黑客事件有关。 | 一系列银行劫案背后的邪恶黑客留下了线索，指向之前就受怀疑的朝鲜。自称Lazarus Group的黑客团伙，被视为一系列银行黑客劫案背后的罪魁祸首，这些劫案包括2016年2月孟加拉央行SWIFT交易软件漏出的8100万美元。
"북한, 방글라데시 은행서 900억원 탈취 성공" · 2017-04-27
attribution sentence(s): 북한의 사이버공격집단이 지난해에만 900억원 상당의 외화 탈취에 성공했다는 분석이 제기됐다. | 민족국가의 사이버절도 행위가 북한의 사례였다. | 보고서에 따르면 시만텍은 방글라데시, 베트남, 에콰도르, 폴란드 등 각국 은행을 겨냥한 해커조직 '라자루스(Lazarus)그룹'의 공격이 북한과 관련된 증거를 발견했다.
Central Bank of Bangladesh · 2016
(MSMT/2025/2, report p. 15) “Temp.Hermit is known for recent supply chain compromises and major cyber incidents such as the 2014 hack against Sony Pictures Entertainment, the 2016 theft of $81 million from the Central Bank of Bangladesh, and the WannaCry ransomware outbreak of 2017.”