Inside the North Korean Hacking Operation Behind SWIFT Bank Attacks

FireEye details how this money-stealing operation it now calls APT 38 has emerged in the past four years and how it operates.

FIREEYE CYBER DEFENSE SUMMIT – Washington, DC – Researchers at FireEye here today shared details about how a North Korean hacking team they have christened APT 38 has attempted to pilfer $1.1 billion from financial institutions worldwide.
FireEye previously had attributed the game-changer cyberattacks on the SWIFT international interbank messaging system in various banks to a North Korean hacking group it calls TEMP.Hermit, which mostly had conducted cyber espionage attacks against energy and the defense sectors in South Korea and the US.
APT 38s main objectives, however, are financially motivated on behalf of the North Korean government: Since 2015, the hacking team has stolen hundreds of millions of dollars from at least five banks (including Bangladesh Bank and Banco de Chile) and has hacked into 16 organizations in 11 countries in Latin America and Europe, plus the US, for example, according to FireEye.
This is the first time weve seen a cybercrime group essentially funding a regime, said Nalani Fraser, manager of threat intelligence at FireEye, of the North Korean group.
North Korean nation-state hacking teams typically get lumped together under the name Lazarus Group, the group behind the epic breach, doxing, and data-wiping attacks on Sony Pictures Entertainment in 2014 and WannaCry in 2017. It was after the Sony breach that North Koreas hacking machine began to split into different groups, according to FireEyes analysis, and APT 38 began to emerge as an entity. APT 38s rise coincided with financial pressures due to international economic sanctions against North Korea.
But CrowdStrike says it has been tracking this same group since 2016 – under the moniker Stardust Chollima. Adam Meyers, vice president of intelligence at CrowdStrike, says his firm attributed the hacks against the SWIFT system to the North Korean group.
Stardust Chollima has been associated with numerous financially motivated attacks meant to generate revenue for the North Korean regime. Attacks have included targeting of the international financial system, regional banks in developing economies, and cryptocurrency exchanges and businesses, Meyers says. These attacks are expected to continue due to the economic impact on the DPRK due to international sanctions.
No Smash-and-Grab
Theres still plenty of overlap among all three of the main North Korean hacking groups, but FireEye researchers say APT 38 stands apart with its specialized custom tools and focus on financial organization operations. APT 38 employs at least 39 toolsets and is known for its deep study of its targets, often remaining inside a targets network for long periods of time before making a move on its data. Its no smash-and-grab operation, said Jacqueline OLeary, senior threat intelligence analyst at FireEye.
On average, APT 38 spends 155 days in a compromised network. In one case, it sat quietly on a victims network for two years before making its move for money. They can balance multiple motivations, theyre financially motivated, and they operate like a traditional espionage operation, OLeary said. Sometimes they wait two years before attempting transactions from a bank, for example.
APT 38 spends that time gathering credentials, mapping the network, and scanning systems for information and vulnerabilities.
Once we saw them leverage a legitimate file program that was already inherent on a compromised host, and they actually used it to transfer and delete the malware, OLeary said. And another time we saw them incorporate a hard-coded proxy IP into their malware that was actually specific to the victims environment.
When APT 38 began to pivot to the SWIFT servers in bank targets, for example, it used a mix of homegrown and legitimate tools: In one case, they used sysmon to gather users and processes that have access to the SWIFT servers, Fraser said. Weve also seen them use both passive and active backdoors ... to tunnel and get access to internal systems, she said.
To transfer stolen funds, APT 38 uses its so-called DYEPACK malware for the fraudulent transactions, which mostly were performed in less conspicuous increments and sent to nations with lax money-laundering laws.
Then they proceed to burn down the house, Fraser said, including deleting log histories and launching distractions such as ransomware attacks. In one case, it was a phony ransomware attack that wasnt even set up to collect ransom, she said. That distracted the investigators and then they proceeded to wipe disks, Fraser said.
At one bank, some 10,000 workstations and servers were taken offline by APT 38s destructive cleanup operation to cover its tracks. Employees walked in to blue screens ... it was just chaos, Fraser said.
APT 38 also has shown some savvy: In certain cases, weve observed that they initiate an AV scan on a compromised host to see if their own malware would be detected, OLeary said.
And in keeping with its stealthy approach, APT 38s malware often is difficult to detect. Take its SWIFT-attack malware, which runs in memory so its not easily detected. SWIFT malware is never on disk, said Chris DiGiamo, technical director of FireEyes Mandiant team.
FireEye today also published
a blog
and report on APT 38.

Black Hat Europe returns to London Dec 3-6 2018 with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the
conference
and
to register.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Inside the North Korean Hacking Operation Behind SWIFT Bank Attacks