Neighborhood Watch: Identifying Early Indicators of the Central Bank of Bangladesh Heist

By John Wetzel on March 29, 2016

As a threat intelligence analyst, the largest impact you make may be the observation of early indicators of compromise (IOCs) on other companies within your industry vertical. When you see the neighbor’s house on fire, the first thing to do is determine whether your house is on fire as well. In early hacks, this equates to “Am I being attacked or am I about to be attacked?”

Using Recorded Future, we’re going to demonstrate how to take an observation of a compromise, identify the basic information, research the compromise, analyze the content, and draw conclusions with a plan of action for further research.

Use Case: Central Bank of Bangladesh

Let’s assume you’re part of a financial company (though this model can be adjusted to any industry). We’ll use the generic cyber dashboard, but a similar process is possible if you have a tailored cyber view.

Our cyber dashboard is a customizable quick look at the entire world of open source activity related to cyber attacks. There are broad columns populated with All Attackers, All Methods, All Targets, and All Operations. You can also add columns related to Authors (of content) and Indicators. Each column can be filtered to specific entity groups within the column headers — All Attackers related to China, for example.

Looking at the All Targets column, “Bangladesh” and, more specifically, “Central Bank of Bangladesh,” appear near the top. Recorded Future helps to prioritize where you need to spend your time on research and analysis. We’re seeing a high level of activity on “Central Bank of Bangladesh,” but what does that involve? Time for a deeper dive.

Clicking on “What recent cyber events involve the Central Bank of Bangladesh,” we see our fears confirmed — there’s a cyber incident involving the Central Bank of Bangladesh, which we’ll refer to as CBB for brevity’s sake. The timeline view can provide an easy insight into the event structure and how it develops. In this case, we see a smaller bump a month after the main spike in activity.

Focusing in on this bump of reports, we discover CBB was hacked back in early February, but the main reporting on this event didn’t occur until over a month later. The Philippines media initially broke the story of the hack, a point of controversy between the government of Bangladesh and the Central Bank. The Recorded Future timeline helps threat intelligence teams identify these trends earlier and prioritize their importance.

Looking at further incidents, we find a report alleging that Chinese hackers breached the Federal Reserve, and stole over $100 million from CBB. Interestingly, as we’ll see, almost everything in this report is false.

As is often the case with early reporting, there will be many alarming and extreme reports, emphasized by inaccurate, incomplete, and contradictory details. As reports develop, we’ll see less of these inaccurate reports in the timeline, and more of the accurate information.

Early Findings

Banks and financial institutions are particularly susceptible to broad infrastructure attacks from hackers. Most banks are linked by mutual agreements and trading structures, such as clearing houses, and transactional systems, such as SWIFT. This linkage provides a common surface to attack, posing a danger to anyone connected to it. Good threat intelligence practices and monitoring detects danger earlier and prioritizes threat mitigation tasks.

By switching to the table view, we can discover more detail concerning the events, such as summaries of the reported cyber events, in chronological order. These events are sortable by the different attributes, located in the column on the left. Now we can begin to draw a some initial ideas about this event:

Initial Review

Who	Hackers (unknown), CBB, Federal Reserve Bank
What	Massive transfer of funds, over $100M?
Where	Bangladesh, New York, Phillippines
When	February 4-5, 2016
How	Malware attack? Federal Reserve hacked?

After initial review, it’s important to identify the specifics of the attack and create a task list for further research on our internal systems. Threat intelligence gives you multiple ways of conducting the open source research and identifying the tactical information needed for research, whether in the timeline, the dashboard, or using one of the other applications. One of the ways Recorded Future displays information is by references, as shown above. References are summarized in the table view, and can also be individually explored.

After conducting this research, this is the summary we’re able to draw:

	Initial Review	Final Review
Who	Hackers (unknown), CBB, Federal Reserve Bank	Hackers (unknown), CBB, Federal Reserve Bank, SWIFT, intermediary banks and NGOs
What	Massive transfer of funds, over $100M?	$81 million stolen, additional $850-$870 million in attempted transfers
Where	Bangladesh, New York, Philippines	Bangladesh, New York, Philippines, Sri Lanka, Hong Kong
When	February 4-5, 2016	Intrusion as early as January, discovered February 4-5, 2016, reported last week
How	Malware attack? Federal Reserve hacked?	Compromised credentials by malware on CBB intranet connected to SWIFT

Now What?

Using this information, we can begin to answer our initial questions. Are we being attacked, or are we about to be attacked? This attack appears particularly targeted, utilizing very specialized knowledge about the CBB and SWIFT transactions. The likely answer is no, however the situation will become much more complex if analysis reveals the hackers utilized an unpatched or undisclosed vulnerability. This situation should continue to be monitored, however none of the immediate reports point to the compromise.

Moving on to the second question, we can use the above information to prioritize our internal search. The Federal Reserve and SWIFT were adamant in their statement that the network had not been compromised, and that valid codes were used to certify the SWIFT transactions. It appears the primary point of intrusion was the CBB intranet nodes connected to the SWIFT transaction network. A good starting point might be a review of the SWIFT transactions conducted at your institution, followed by a vulnerability assessment on the SWIFT or other banking credentials stored and utilized on your networks. Lastly, implementation of higher security for credentials, including two-factor authentication, should be implemented.

Always on Alert

In conclusion, like a fire at your neighbor’s house, attacks on companies in or near your business space need to be very carefully watched. “Neighborhood” attacks should be reviewed for vulnerabilities to your networks, lessons learned, and internal research prioritization. Recorded Future assists threat intelligence analysts with these functions and more.