The same code appears to have been used to attack Sony and banks in Vietnam, Bangladesh.
The attempted billion dollar attack on the Bangladesh Central Bank was not an isolated incident, according to a report today from the SWIFT payment network. Some of the malware used in the Bangladesh heist has been found in another attack on a bank. SWIFT didn't name the other bank, but BAE Systems, which has been investigating the Bangladesh attack, has said that a Vietnamese commercial bank has been hit by closely related malware in a report of its own.
In February, unknown hackers broke into the Bangladesh Bank and nearly got away with a sum just shy of $1 billion. In that event, their fraudulent transactions were cancelled when a typo raised concerns about one of the transactions. The thieves still succeeded in transferring $81 million, and that money is still unrecovered. In April, we learned that preliminary investigations had revealed the use of cheap networking and a lack of firewalls, both contributing to the attack. The SWIFT organization is owned by 3,000 financial companies and operates a network for sending financial transactions between financial institutions. The SWIFT network was used to move the stolen money.
According to BAE, the malware used in both hacks has a range of similarities, including the names of the malicious executables, the internal structure of the code, and in particular a distinctive block of code used to securely wipe files and cover up the evidence of the attack.
BAE has found a surprising third use of the same deletion routines and other code features—these tactics were deployed in some of the malware used in the 2014 Sony attack that saw vast quantities of data from Sony Pictures published online. The FBI asserted that the Sony hack was the work of North Korea. Publicly, a group calling itself the Guardians of Peace claimed responsibility, saying the hack was retaliation for the Sony produced film The Interview, which depicted the assassination of North Korean dictator Kim Jong-un.
The data deletion routines used in the Sony attacks were themselves used to tie that hack to 2013 attacks made on South Korean banks and media outlets.
BAE notes that attribution is not an exact science. While the re-use of existing code suggests that the same group—even the same developer—is responsible for creating the malware, it's possible the attackers deliberately crafted their malware to merely give the appearance of being related.
SWIFT's report also described some new features of the Vietnamese attack. In Bangladesh, the malware took considerable effort to cover up its tracks and hide the bogus transactions, modifying databases and deleting incriminating data. This cover-up indicated extensive knowledge of the software and systems used to transfer money, and that same extensive knowledge appears to be present in the Vietnamese case. Staff in Vietnam used PDF reports to inspect payment confirmations. The attackers produced a trojaned version of the PDF reader that looks like the regular software, but it instead detects when the fraudulent transactions are being examined and shows bank staff different data to hide the fraud.
