It has happened again, unknown hackers have stolen $10 million from an unnamed Ukrainian bank through the SWIFT loophole. The news was released by the Kyiv branch of ISACA, the Information Systems Audit and Control Association, which confirmed the fraudulent activity was carried on through the SWIFT international banking system that manage money transfers between financial institutions worldwide.
The ISACA organization has been hired by the Ukrainian bank to investigate the cyber attack. It seems that dozen of banks have been compromised as well, resulting in hundreds of millions of dollars in losses.
“At the current moment, dozens of banks (mostly in Ukraine and Russia) have been compromised, from which has been stolen hundreds of millions of dollars,” the ISACA reported in a press release cited by the Ukranian kyivpost.com.
A member of ISACA confirmed that attacks like the one they are investigating are very time-consuming. Attackers breach the financial institution’s internal networks for months in order to gather information necessary to the attack. The reconnaissance phase allows them to study the internal processes and controls implemented by the bank, and the gathered data are then used to perform fraudulent money transfers.
According to the experts from ISACA, the cyber criminals used publicly available information and tools to steal money from the Ukrainian Bank; they likely targeted other financial institutions in the country benefiting from the lack of information sharing about the attacks.
“Banks now are not sharing such information at all and are afraid of publicity,” explained Aleksey Yankovsky, head of ISACA’s Kyiv division.
Exactly one month ago, a fourth Bank in the Philippines was a victim of the SWIFT hackers and experts at Symantec confirmed the malware shares code with tools used by the Lazarus group.
In May, the media also announced the second and the third victim of SWIFT hackers, meanwhile the first attack went public in February when hackers stole $81 million from the Bangladesh central bank.
(Security Affairs – SWIFT hackers, Bangladesh attack)
Share On
