DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

Fraudulent wire transfers from the Vietnamese Bank

Date (as written)
On December 9, 2015
Year
2015
Country
Vietnam
Actors (as written)
JON CHANG HYOK, KIM IL, PARK JIN HYOK and other hackers/conspirators (RGB)
Actor pages
JON CHANG HYOKKIM ILPARK JIN HYOKhackersconspirators
Tags (as written)
bank theft; SWIFT; indictment overt act
Dollar figures (as written)
$1.1 millions; $1.1 million; approximately €2 million; approximately $3.4 million (attempted); A$1 million (attempted); g90 million (attempted, as extracted; likely ¥); $3.4 million; $1 million

Source entries (6)

lazarus.day

Tien Pong Bank · 2015-05
Vietnam’s Tien Phong Bank reported an attempted theft of more than EUR 1 million through fraudulent SWIFT messages in 2015. Linked financial-incident and UN Panel reporting place the case within the broader DPRK/Lazarus-associated pattern of SWIFT-enabled bank theft attempts, but provide limited public detail on the intrusion chain.
https://lazarus.day/incidents/tpbank/

CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA)

Tien Phong Bank · 2016-05-13
SWIFT confirms a new attack in which attackers managed to illegally transfer funds from a member bank by using its system. Further details, including the bank name are revealed two days after. The victim is the Tien Phong Bank in Vietnam.
https://www.reuters.com/article/us-vietnam-cybercrime-idUSKCN0Y60EN

UN Panel of Experts S/2019/691

Attempted theft of more than 1 million Euro ($1.1 millions) of funds through fraudulent SWIFT messages · Dec 2015
Annex 21: Suspected DPRK cyber-attacks on financial institutions (including banks and cryptocurrency exchanges) investigated by the Panel. A. Banks. Attempted theft of more than 1 million Euro ($1.1 millions) of funds through fraudulent SWIFT messages according to statement Tien Phong Bank later issued.
https://undocs.org/S/2019/691

Mendeley Data: Collection of DPRK state-sponsored threat actors' activities v2 (Lyu, Sungkyunkwan Univ.)

Tien Pong Bank · 2015-05
Reported: 2015-05; Victims: Tien Pong Bank; Motivations: FinancialGain; Sectors: Finance; Countries: Viet Nam
https://data.mendeley.com/datasets/wwb2rzgfn7/2

US court filing via CourtListener RECAP: United States v. Hyok

Intrusion at the "Vietnamese Bank": fraudulent SWIFT messages; malware disguised as FoxIt Reader
malware (FoxItReader.exe) recovered from a computer at the Vietnamese Bank. Officials at the Vietnamese Bank have informed the FBI that the SWIFT messages that were sent were fraudulently created as a result of a computer intrusion. [Case No. 2:18-mj-01479, U.S. District Court for the Central District of California; filing: COMPLAINT filed as to Defendant Park Jin Hyok in violation of 18:371; 18:1349. Approved by Magistrate Judge Rozella A. O]
https://storage.courtlistener.com/recap/gov.uscourts.cacd.713818/gov.uscourts.cacd.713818.1.0.pdf

US court filing via CourtListener RECAP: United States v. Hyok

Fraudulent wire transfers from the Vietnamese Bank · On December 9, 2015
Overt Act No. 5: On December 9, 2015, having gained unauthorized access to the Vietnamese Bank’s computer network at an earlier date, the hackers conducted false and fraudulent wire transfers totaling approximately €2 million to bank accounts in Slovenia and Bulgaria, and attempted to conduct fraudulent wire transfers of approximately $3.4 million to Russia, A$1 million to Australia, and g90 million to Japan. [Case No. 2:20-cr-00614, U.S. District Court for the Central District of California; filing: SEALED INDICTMENT filed as to Jon Chang Hyok]
https://storage.courtlistener.com/recap/gov.uscourts.cacd.804762/gov.uscourts.cacd.804762.8.0_1.pdf

Values found later for empty fields

dollar figures: Attempted theft of more than 1 million Euro ($1.1 millions)
Dec 2015 Vietnam Attempted theft of more than 1 million Euro ($1.1 millions) of funds through fraudulent SWIFT messages according to statement Tien Phong Bank later issued.
https://undocs.org/S/2019/691
dollar figures: approximately €2 million (conducted); attempted approximately $3.4 million to Russia, A$1 million to Australia, and ¥90 million to Japan
On December 9, 2015, having gained unauthorized access to the Vietnamese Bank's computer network at an earlier date, the hackers conducted false and fraudulent wire transfers totaling approximately €2 million to bank accounts in Slovenia and Bulgaria, and attempted to conduct fraudulent wire transfers of approximately $3.4 million to Russia, A$1 million to Australia, and [yen symbol]90 million to Japan.
https://www.justice.gov/opa/press-release/file/1367701/download

Suggest a correction on GitHub