Bangladesh Bank heist TARGETS Bangladesh Bank
The robbers selected Bangladesh Bank as the target for their billion-dollar cyber-heist.
Explicit Confidence 99% · Jack Rhysider EP 72 Details
“The Bangladesh Bank became the target.”
Incident
incident:bangladesh_bank_heist
Also: Bangladesh Bank robbery, cyber-heist of Bangladesh Bank
The 2016 cyber-enabled theft in which attackers attempted to transfer nearly $1 billion from Bangladesh Bank and successfully obtained $81 million.
The 2016 cyber-enabled theft in which attackers attempted to transfer nearly $1 billion from Bangladesh Bank and successfully obtained $81 million.
“The thirty-six transactions totaled 951 million dollars.”
“the hackers were able to successfully steal 81 million dollars from the Bangladesh Bank”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | TARGETS | Bangladesh Bank | Explicit | 72 |
| outgoing | COMPROMISES | Bangladesh Bank | Explicit | 72 |
| outgoing | INITIAL_ACCESS_VIA | phishing | Explicit | 72 |
| outgoing | INVOLVES | spear phishing | Explicit | 72 |
| outgoing | INVOLVES | Backdoor | Explicit | 72 |
| outgoing | INVOLVES | encrypted channel | Explicit | 72 |
| outgoing | INVOLVES | network scanning | Explicit | 72 |
| outgoing | INVOLVES | lateral movement | Explicit | 72 |
| outgoing | INVOLVES | persistence | Explicit | 72 |
| outgoing | INVOLVES | SWIFT | Explicit | 72 |
| outgoing | COMPROMISES | SWIFT terminal | Explicit | 72 |
| outgoing | TARGETS | New York Federal Reserve Bank | Explicit | 72 |
| outgoing | INVOLVES | New York Federal Reserve Bank | Explicit | 72 |
| outgoing | INVOLVES | transaction-record deletion malware | Explicit | 72 |
| outgoing | INVOLVES | printer manipulation | Explicit | 72 |
| outgoing | INVOLVES | money laundering | Explicit | 72 |
| outgoing | INVOLVES | RCBC Bank | Explicit | 72 |
| outgoing | INVOLVES | Midas Casino | Explicit | 72 |
| outgoing | INVOLVES | Solaire Casino | Explicit | 72 |
| outgoing | INVOLVES | junket room | Explicit | 72 |
| outgoing | ATTRIBUTED_TO | Lazarus Group | Attributed | 72 |
| outgoing | ATTRIBUTED_TO | North Korea | Attributed | 72 |
| outgoing | ATTRIBUTED_TO | Park Jin Hyok | Attributed | 72 |
Bangladesh Bank heist TARGETS Bangladesh Bank
The robbers selected Bangladesh Bank as the target for their billion-dollar cyber-heist.
Explicit Confidence 99% · Jack Rhysider EP 72 Details
“The Bangladesh Bank became the target.”
Bangladesh Bank heist COMPROMISES Bangladesh Bank
The hackers infiltrated Bangladesh Bank's network and carried out fraudulent transfers.
Explicit Confidence 99% · Jack Rhysider EP 72 Details
“the hackers entered the Bangladesh Bank network one more time”
Bangladesh Bank heist INITIAL_ACCESS_VIA phishing
Initial access was obtained through phishing emails containing a purported job applicant's CV.
Explicit Confidence 99% · Geoff White EP 72 Details
“A few employees get the classic phishing e-mail; it’s a zip file that contains a CV”
Bangladesh Bank heist INVOLVES spear phishing
The attackers launched a successful spear-phishing operation against Bangladesh Bank employees.
Explicit Confidence 99% · Jack Rhysider EP 72 Details
“They launched a successful spear phishing operation on Bangladesh Bank employees”
Bangladesh Bank heist INVOLVES Backdoor
One malware component created a backdoor into Bangladesh Bank.
Explicit Confidence 98% · Geoff White EP 72 Details
“one of them created the backdoor into Bangladesh Bank”
Bangladesh Bank heist INVOLVES encrypted channel
One malware component created an encrypted channel to conceal activity through the backdoor.
Explicit Confidence 98% · Geoff White EP 72 Details
“created the encrypted channel so that you could pull stuff out of that backdoor without being spotted”
Bangladesh Bank heist INVOLVES network scanning
The attackers used software to scan and navigate across Bangladesh Bank's network.
Explicit Confidence 98% · Geoff White EP 72 Details
“the third piece of software was used to scan and navigate across the network”
Bangladesh Bank heist INVOLVES lateral movement
After compromising one computer, the attackers moved around the bank's network.
Explicit Confidence 98% · Jack Rhysider EP 72 Details
“From there they have to try to hop around to other computers in the network.”
Bangladesh Bank heist INVOLVES persistence
The attackers established persistence while mapping the bank's network and learning how to transfer money.
Explicit Confidence 98% · Jack Rhysider EP 72 Details
“moving around, establishing persistence, and learning about how to transfer money around”
Bangladesh Bank heist INVOLVES SWIFT
The heist involved using SWIFT to issue fraudulent international payment instructions.
Explicit Confidence 99% · Geoff White EP 72 Details
“we’re gonna have to get to the SWIFT software and do a series of transfers using SWIFT”
Bangladesh Bank heist COMPROMISES SWIFT terminal
The attackers located and manipulated the computer terminal authorized to make SWIFT transfers.
Explicit Confidence 99% · Geoff White EP 72 Details
“find the computer that’s got SWIFT on it so that they can then manipulate that computer”
Bangladesh Bank heist TARGETS New York Federal Reserve Bank
The attackers targeted Bangladesh Bank's foreign-currency reserve account held at the New York Federal Reserve Bank.
Explicit Confidence 98% · Geoff White EP 72 Details
“the Bangladesh Bank has a foreign currency reserve account in New York at the New York Fed”
Bangladesh Bank heist INVOLVES transaction-record deletion malware
Malware installed on the affected machines deleted evidence of the fraudulent transactions.
Explicit Confidence 99% · Jack Rhysider EP 72 Details
“The malware that they had installed on the machines began deleting evidence of their crime.”
Bangladesh Bank heist INVOLVES printer manipulation
The attackers hacked the bank printer so that transaction records appeared as blank pages.
Explicit Confidence 99% · Jack Rhysider EP 72 Details
“the thieves hacked the printer to make it print blank pages of transaction records”
Bangladesh Bank heist INVOLVES money laundering
Breaking the theft into many smaller transfers was described as a classic money-laundering technique.
Explicit Confidence 97% · Geoff White EP 72 Details
“This is classic money laundering technique.”
Bangladesh Bank heist INVOLVES RCBC Bank
The stolen funds were transferred to five accounts at RCBC Bank in the Philippines.
Explicit Confidence 99% · Jack Rhysider EP 72 Details
“The bank robbers successfully transferred 81 million dollars to their five RCBC bank accounts”
Bangladesh Bank heist INVOLVES Midas Casino
Part of the stolen funds was sent to Midas Casino for laundering.
Explicit Confidence 96% · Geoff White EP 72 Details
“One’s called the Midas Casino and one’s called the Solaire Casino”
Bangladesh Bank heist INVOLVES Solaire Casino
Part of the stolen funds was sent to Solaire Casino for laundering.
Explicit Confidence 99% · Geoff White EP 72 Details
“I think it was thirty million in the Solaire and twenty million in the Midas.”
Bangladesh Bank heist INVOLVES junket room
Chinese men working with the hackers used private junket rooms to gamble the stolen money.
Explicit Confidence 98% · Jack Rhysider EP 72 Details
“went into the casino, and requested a junket”
Bangladesh Bank heist ATTRIBUTED_TO Lazarus Group
The episode says security researchers identified the hackers as the Lazarus Group, also known as APT38 and the Reconnaissance General Bureau.
Attributed Confidence 94% · Jack Rhysider EP 72 Details
“Security researchers dubbed this North Korean hacking group the Lazarus Group”
Bangladesh Bank heist ATTRIBUTED_TO North Korea
The US Department of Justice alleged that the conspiracy behind the Bangladesh Bank heist acted on behalf of the North Korean government.
Attributed Confidence 98% · Doj EP 72 Details
“a conspiracy that conducted sophisticated cyber-attacks around the world on behalf of the North Korean government”
Bangladesh Bank heist ATTRIBUTED_TO Park Jin Hyok
The DOJ complaint specifically charged Park Jin Hyok while alleging a wider conspiracy responsible for the Bangladesh Bank cyber-heist.
Attributed Confidence 90% · Doj EP 72 Details
“The criminal complaint unsealed today specifically charges Park Jin Hyok”
“the cyber-heist of Bangladesh Bank”
Bangladesh Bank heist INVOLVES New York Federal Reserve Bank
The New York Federal Reserve processed some fraudulent SWIFT requests and later helped stop or reverse additional transfers.
Explicit Confidence 99% · Jack Rhysider EP 72 Details
“The New York Federal Reserve approves the request”