Neighborhood Watch: Identifying Early Indicators of the Central Bank of Bangladesh Heist

Analysis Summary

• Utilizing stolen SWIFT credentials, hackers recently targeted the Central Bank of Bangladesh, ultimately stealing over $87 million via transfers through multiple financial institutions.
• Early threat intelligence analysis provides a proactive path to discovery of potential vulnerabilities, and a guide to further internal research.
• Identification of the hackers’ TTPs, their methods of attack, and other IOCs will accelerate your security team’s response.

As a threat intelligence analyst, the largest impact you make may be the observation of early indicators of compromise (IOCs) on other companies within your industry vertical. When you see the neighbor’s house on fire, the first thing to do is determine whether your house is on fire as well. In early hacks, this equates to “Am I being attacked or am I about to be attacked?”

Using Recorded Future, we’re going to demonstrate how to take an observation of a compromise, identify the basic information, research the compromise, analyze the content, and draw conclusions with a plan of action for further research.

Use Case: Central Bank of Bangladesh

Let’s assume you’re part of a financial company (though this model can be adjusted to any industry). We’ll use the generic cyber dashboard, but a similar process is possible if you have a tailored cyber view.

Our cyber dashboard is a customizable quick look at the entire world of open source activity related to cyber attacks. There are broad columns populated with _ All Attackers_ , _ All Methods_ , _ All Targets_ , and _ All Operations_ . You can also add columns related to _ Authors_ (of content) and _ Indicators_ . Each column can be filtered to specific entity groups within the column headers — _ All Attackers_ related to China, for example.

Looking at the All Targets column, “Bangladesh” and, more specifically, “Central Bank of Bangladesh,” appear near the top. Recorded Future helps to prioritize where you need to spend your time on research and analysis. We’re seeing a high level of activity on “Central Bank of Bangladesh,” but what does that involve? Time for a deeper dive.

Clicking on “What recent cyber events involve the Central Bank of Bangladesh,” we see our fears confirmed — there’s a cyber incident involving the Central Bank of Bangladesh, which we’ll refer to as CBB for brevity’s sake. The _ timeline view_ can provide an easy insight into the event structure and how it develops. In this case, we see a smaller bump a month after the main spike in activity.

Focusing in on this bump of reports, we discover CBB was hacked back in early February, but the main reporting on this event didn’t occur until over a month later. The Philippines media initially broke the story of the hack, a point of controversy between the government of Bangladesh and the Central Bank. The Recorded Future timeline helps threat intelligence teams identify these trends earlier and prioritize their importance.

Looking at further incidents, we find a report alleging that Chinese hackers breached the Federal Reserve, and stole over $100 million from CBB. Interestingly, as we’ll see, almost everything in this report is false.

As is often the case with early reporting, there will be many alarming and extreme reports, emphasized by inaccurate, incomplete, and contradictory details. As reports develop, we’ll see less of these inaccurate reports in the timeline, and more of the accurate information.

Early Findings

Banks and financial institutions are particularly susceptible to broad infrastructure attacks from hackers. Most banks are linked by mutual agreements and trading structures, such as clearing houses, and transactional systems, such as SWIFT. This linkage provides a common surface to attack, posing a danger to anyone connected to it. Good threat intelligence practices and monitoring detects danger earlier and prioritizes threat mitigation tasks.

By switching to the _ table view_ , we can discover more detail concerning the events, such as summaries of the reported cyber events, in chronological order. These events are sortable by the different attributes, located in the column on the left. Now we can begin to draw a some initial ideas about this event:

Initial Review

Who	Hackers (unknown), CBB, Federal Reserve Bank
What	Massive transfer of funds, over $100M?
Where	Bangladesh, New York, Phillippines
When	February 4-5, 2016
How	Malware attack? Federal Reserve hacked?

After initial review, it’s important to identify the specifics of the attack and create a task list for further research on our internal systems. Threat intelligence gives you multiple ways of conducting the open source research and identifying the tactical information needed for research, whether in the timeline, the dashboard, or using one of the other applications. One of the ways Recorded Future displays information is by references, as shown above. References are summarized in the table view, and can also be individually explored.

After conducting this research, this is the summary we’re able to draw: