SWIFT: another unnamed bank is hit by cyber attack
Another cyber attack, like the one that hit Bangladesh's central bank, has now hit an unnamed commercial bank, according to Swift, which overseas the financial messaging network that underpins global money transfers; the attack used techniques and tools resembling those used to steal $81m from Bangladesh in February. On both occasions, the thieves sought to submit fraudulent messages to the Swift network so as to transfer huge amounts of cash to accounts that they controlled. Swift warns the attackers had a "deep and sophisticated knowledge of specific operational controls" at the targeted bank, and may have been helped in their theft by "malicious insiders".
Swift, the global financial messaging network that banks use to move billions of dollars every day, warned on Thursday of a second malware attack similar to the one that led to February’s $81 million cyberheist at the Bangladesh central bank.

The second case targeted a commercial bank, Swift spokeswoman Natasha de Teran said, without naming it. It was not immediately clear how much money, if any, was stolen in the second attack.

Swift said in a statement that the attackers exhibited a “deep and sophisticated knowledge of specific operational controls” at targeted banks and may have been aided by “malicious insiders or cyber attacks, or a combination of both”.



The organization, a Belgian co-operative owned by member banks, said that forensic experts believe the second case showed that the Bangladesh heist was not a single occurrence, “but part of a wider and highly adaptive campaign targeting banks.“

News of a second case comes as law enforcement authorities in Bangladesh and elsewhere investigate the February cyber theft from the Bangladesh central bank account at the New York Federal Reserve Bank. Swift has acknowledged that that scheme involved altering Swift software to hide evidence of fraudulent transfers, but that its core messaging system was not harmed.

In both cases Swift said insiders or cyber attackers had succeeded in penetrating the targeted banks’ systems, obtaining user credentials and submitting fraudulent Swift messages that correspond with transfers of money.

In the second case SWIFT said attackers had also used a kind of malware called a “Trojan PDF reader” to manipulate PDF reports confirming the messages in order to hide their tracks.