SWIFT warns of malware attack on another of its customers

Funds transfer network SWIFT has warned banks to be on the alert for attempts to replicate an attack that tried to net $1 billion from Bangladesh Bank

Financial transaction network SWIFT has renewed its warning to customers to be on their guard following the discovery of malware at another bank using its services.

The bank first asked customers to take steps to secure their systems in the wake of an attempt to steal US$951 million from Bangladesh Bank in February. Attackers there appear to have used custom malware installed on computers at the bank to send fraudulent messages over the SWIFT network seeking to transfer money from the bank's account with the U.S. Federal Reserve Bank of New York.

That attack appears not to have been an isolated incident, as SWIFT said Friday it has now learnt more about a second instance in which malware was used.

While SWIFT did not name the target, a report from security researchers at BAE Systems, also published Friday, pointed to a commercial bank in Vietnam as the latest victim.

The malware attacks were not directly on the transaction network or core messaging system, but instead were targeted at customer banks' secondary security controls, SWIFT said.

With its ability to transfer billions of dollars to accounts around the world in a few keystrokes, the SWIFT financial transaction network is increasingly being instrumentalized in cyber attacks on financial institutions.

While the number of cases of fraud at its customers is so far small, forensic experts believe the new discovery is part of a wider and highly adaptive campaign targeting banks, SWIFT said.

Posting on the BAE Systems threat research blog, researchers Sergei Shevchenko and Adrian Nish said what ties together the cases discovered so far is the use of an unusual file wipe function the malware uses to make deleted files unrecoverable. The function first fills the file with random characters to ensure nothing can be recovered from the sectors it occupies on disk, then changes its name to a random string before deleting it.

In both cases, SWIFT said in its latest warning, the attackers have exploited vulnerabilities in the systems banks use to initiate fund transfers, stealing banks' credentials and using them to send irrevocable fund transfer orders over the SWIFT network.

In addition, the attackers have tampered with secondary controls such as records of statements and confirmations that the banks use to recognize fraud. For example, SWIFT said, in the latest case the attackers targeted the bank's PDF reader, using malices software to modify it so as to hide traces of the fraudulent transactions in PDF reports of payment confirmations.

SWIFT asked its customers to review security controls across all their payment systems, from employee checks to cyber defenses. Banks using PDF reader applications to review confirmation messages should take particular care, it said. The asked banks to help track down the fraudsters by advising it if any incidents were discovered.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Peter Sayer

Peter Sayer

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?