$100 Million Bank Heist Brought To Light By “Fandation” – A Typo
Financial institutions in the Middle East are deeply concerned about their cyber-presence, as cyber-attacks have escalated over a period of very short time.
The hackers/ cybercriminals are launching highly sophisticated/ undetectable Trojans and ransomware. One of the most prevalent ransomware is ‘locky’, which encrypts user data, and threatens to delete everything if the victim does not pay compensation. Of course anti-virus companies are working on a solution against ‘locky’, but without much luck.
With almost all banks in the region now using the latest technology and network controls to guard their boundaries, such attacks have reached a new level.
In what might be considered one of the most ridiculous bank raids to date, the central Bank of Bangladesh experienced a higher level of theft as undetected attackers conducted a thorough and careful study of the bank’s operations and security systems and disguised as bank officials, requested a series of large money transfers orders for the New York Federal reserve. They successfully made away with a large amount of money, believed to be approximately $100mn.
The attackers carefully transferred this money to independent areas and regions but in a bid to operate discreetly, the money was separated and independently transferred across areas. $80mn dollars is believed to have successfully ended up in the Philippines, whereas the remaining $20mn was being transferred to an NGO in Sri Lanka.
Something about this last transaction did not seem right: firstly the amount was unpopular in this NGO. It was relatively large compared to previous transactions; secondly the name of the NGO was spelt incorrectly. Consequently, suspicions were aroused which alerted officials of the situation.
According to Reuters, Bangladesh banking officials said that the cyber-criminals were ultimately stopped when they made a spelling mistake in one of their transfer instructions. The hackers misspelled the name of a Sri Lankan NGO, writing “foundation” as “fandation” which prompted a routing bank to query the transaction and led to the crime being stopped, meaning $1bn was not transferred.
Institutions in the Middle East will now be forced to boost their security levels in order to track down potential criminals. This will call for the introduction of strict security measures and reinforcements. Security should not be a simple item on a checklist; it should be a process, an attitude and a mindset.
This incident adds to the growing list of proof points that support this statement, especially now that cyber-attacks are getting bigger and definitely more “real” in terms of impact. Security measures will be put in place to track anomalies and watch out for hackers.
Furthermore, banks in the Middle East will learn not to play with trust issues and they will not take fundamental questions lightly. Questions should not be taken lightly, including: Who in your organization has access to the most important data? How do you ensure that this data is protected? Do your processes, policies and your infrastructure empower your employees to see “trigger warnings” and perform appropriate action at the right time? Do employees have a clean or dirty working background?
On the other hand it will negatively impact the Middle East as it will lead a reduction in clients as customers will be scared of losing their assets. This will lead to a fall in reputation. Finally, it will reduce the amount of money in circulation as the Central Bank is responsible for issue of currency.
An earlier version of this article appeared on infosecurity-magazine.com
The views expressed in this article are those of the author and do not necessarily represent the views of CourtingTheLaw.com or any organization with which he might be associated.
