Security researchers Symantec have found clues in the malware used to hack into international financial messaging network Swift, which suggest a link to the Sony Pictures hack in 2014.
At least three banks have reported financial attacks based on the Swift hack. In February, Bangladesh’s central bank lost $81m (£55m) after fraudulent messages were sent through the network instructing a transfer to an account in the Philippines. In May, a Vietnamese bank came forward to say that it had been targeted by the hackers as well, and had managed to stop a $1m transfer. And later that month, Reuters revealed that a third bank, Ecuador’s Banco del Austro, had also fallen prey.
At heart, all the hacks relied on social engineering as much as technical talent. Once the attackers gained fraudulent access to the Swift network, they simply messaged the banks’ banks, and asked for funds to be transferred – which, generally, they were. The Bangladesh case only came to light because a typo in one of the instructions alerted a worker.
But in order to gain access to the network, the attackers used a specific type of malware, dubbed Trojan.Banswift by Symantec.
The security research firm analysed the malware used in the Bangladesh attack, and found what it describes as “a distinct file wiping code”. The way the software deleted files was like little else the company had seen, but it had been seen in one other piece of malware, a specimen named Backdoor.Contopee, which had been used to hack into financial organisations in south-east Asia.
Programmers often have quirks that make it into their code, and they also reuse code between projects. Symantec says it believes “distinctive code shared between families and the fact that Backdoor.Contopee was being used in limited targeted attacks against financial institutions in the region, means these tools can be attributed to the same group.”
That means the hackers, who gained public notoriety with the Bangladesh hack, may have been attacking financial institutions for much longer than previously thought.
But it also links them to a wider group of hackers. The Backdoor.Contopee malware has previously been used by a group known as Lazarus, which has been attacking businesses and commercial operations across the US and South Korea for the last six years. And Lazarus, in turn, is “linked” to another piece of software, Backdoor.Destover, which was used in the 2014 hacking attack against Sony, which the FBI ended up attributing to the North Korean state.
The link is not conclusive, however. Hacking groups often share and sell code, and the Sony Pictures hack is several degrees removed from the Swift attacks.
What’s more, Lazarus was severely disrupted earlier this year, Symantec says. “The group was the target of a cross-industry initiative known as Operation Blockbuster earlier this year, which involved major security vendors sharing intelligence and resources in order to assist commercial and government organizations in protecting themselves against Lazarus.”
Swift itself has promised to improve its security following the hacks. According to Information Security magazine, the group’s chief executive offered up a new plan for change. Gottfried Leibbrandt said: “Banks can learn from one another about the modus operandi and put better preventative measures in place; entities like Swift can serve as the information sharing channel, and we can develop indicators of compromise to help those banks improve their detective capabilities.
“We are doing so,” he added, “But information sharing needs to get better, much better.”