SWIFT warns of malware attack on another of its customers

Funds transfer network SWIFT has warned banks to be on the alert for attempts to replicate an attack that tried to net $1 billion from Bangladesh Bank

Financial transaction network SWIFT has renewed its warning to customers to be on their guard following the discovery of malware at another bank using its services.

The bank first asked customers to take steps to secure their systems in the wake of an attempt to steal US$951 million from Bangladesh Bank in February. Attackers there appear to have used custom malware installed on computers at the bank to send fraudulent messages over the SWIFT network seeking to transfer money from the bank's account with the U.S. Federal Reserve Bank of New York.

That attack appears not to have been an isolated incident, as SWIFT said Friday it has now learnt more about a second instance in which malware was used.

While SWIFT did not name the target, a report from security researchers at BAE Systems, also published Friday, pointed to a commercial bank in Vietnam as the latest victim.

The malware attacks were not directly on the transaction network or core messaging system, but instead were targeted at customer banks' secondary security controls, SWIFT said.

With its ability to transfer billions of dollars to accounts around the world in a few keystrokes, the SWIFT financial transaction network is increasingly being instrumentalized in cyber attacks on financial institutions.

While the number of cases of fraud at its customers is so far small, forensic experts believe the new discovery is part of a wider and highly adaptive campaign targeting banks, SWIFT said.

Posting on the BAE Systems threat research blog, researchers Sergei Shevchenko and Adrian Nish said what ties together the cases discovered so far is the use of an unusual file wipe function the malware uses to make deleted files unrecoverable. The function first fills the file with random characters to ensure nothing can be recovered from the sectors it occupies on disk, then changes its name to a random string before deleting it.

In both cases, SWIFT said in its latest warning, the attackers have exploited vulnerabilities in the systems banks use to initiate fund transfers, stealing banks' credentials and using them to send irrevocable fund transfer orders over the SWIFT network.

In addition, the attackers have tampered with secondary controls such as records of statements and confirmations that the banks use to recognize fraud. For example, SWIFT said, in the latest case the attackers targeted the bank's PDF reader, using malices software to modify it so as to hide traces of the fraudulent transactions in PDF reports of payment confirmations.

SWIFT asked its customers to review security controls across all their payment systems, from employee checks to cyber defenses. Banks using PDF reader applications to review confirmation messages should take particular care, it said. The asked banks to help track down the fraudsters by advising it if any incidents were discovered.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Peter Sayer

IDG News Service
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?