Challenge: Bangladesh Bank, the central bank of Bangladesh has a foreign currency reserve of $39 billion. It maintains an account with the Federal Bank of New-York for maintaining and transferring foreign currency reserves in Bangladesh. On 4-5 February, 2016, hackers tried to steal $951 million. They managed to find out how the money transfers are done and also gained credentials for payment transfers. They used these to authorize multiple requests and divert funds to accounts in Sri-lanka and Philippines. Around 5 transactions worth $20 million to Sri-Lanka and $81 million to the Philippines were successful.
Solution: Initially, Bangladesh Bank brought World Informatix Cyber-Security to lead the vulnerability response and remedy. World Informatix Cyber-Security then involved Mandiant, now a partner of Google Cloud for the investigation. As per the investigation, the hijackers were based outside Bangladesh. The investigation showed that there was malware installed in the bank’s system around January, 2016 that helped the hackers take a look at the Bangladesh Bank’s operational procedures. The investigation went to an unresolved case of 2013 Sonali Bank where an unidentified hacker stole $250,000. The report found that the fraud took place using SWIFT global fund transfers.
References:
1.https://www.dhakatribune.com/opinion/op-ed/122939/the-great-bangladesh-cyber-heist-shows-truth-is
2.https://www.reuters.com/article/idUSKBN1700RG/