Between early 2015 and 2016, attackers breached member-bank systems and hijacked legitimate credentials used to access the SWIFT banking network. They then issued fraudulent transfer requests that recipient banks initially trusted as authentic. The most prominent case was the February 2016 theft of $101 million from Bangladesh Bank’s account at the Federal Reserve Bank of New York; a separate attack targeted a commercial bank in Vietnam, while Reuters reported a similar 2015 incident involving Banco del Austro funds sent to Hong Kong.
The malware did more than authorize transfers: it deleted database records and suppressed confirmation evidence. In Bangladesh, it altered printed reports, while in the Vietnamese case it modified a PDF viewer to conceal transactions. Security researchers identified overlaps with malware used in the 2014 Sony Pictures attack and associated the activity with Lazarus Group, which Symantec linked to North Korea; that state attribution remained conditional rather than conclusively established in the source. SWIFT subsequently imposed mandatory security controls, inspections, and noncompliance reporting after officials warned that compromised banks could face existential losses.
