New hacking tactics and cyber thefts revealed

Cyberattacks targeting the global bank transfer system have succeeded in stealing funds since February's heist of $81 million from the Bangladesh central bank as hackers have become more sophisticated in their tactics, according to a SWIFT official and a previously undisclosed letter the organization sent to banks worldwide.

The messaging network in a Nov 2 letter seen by Reuters warned banks of the escalating threat to their systems, according to the SWIFT letter.

The attacks and new hacking tactics underscore the continuing vulnerability of the SWIFT messaging network, which handles trillions of dollars in fund transfers daily.

"The threat is very persistent, adaptive and sophisticated - and it is here to stay," SWIFT said in the November letter to client banks.

The disclosures provide fresh evidence that SWIFT remains at risk of attacks nearly a year after funds were stolen from a Bangladesh Bank account at the Federal Reserve Bank of New York.

Tightened security

The unprecedented cyber theft prompted regulators around the globe to tighten bank security requirements, amidst a global investigation by the FBI, Bangladesh authorities and Interpol.

Banks using the SWIFT network, which include both central banks and commercial banks, have been hit with a "meaningful" number of attacks - about a fifth of them resulting in stolen funds, since the Bangladesh heist, Stephen Gilderdale, head of SWIFT's Customer Security Program, said in a recent interview.

SWIFT, a Belgium-based cooperative owned by its user banks, had previously disclosed hacks of three SWIFT users since February but said those did not lead to the loss of funds.

SWIFT's letter to customers warned that hackers have refined their methods for compromising local bank systems. One new tactic, the letter said, involved using software that allows technicians to access computers to provide technical support.

"We unfortunately continue to see cases in which some of our customers' environments are being compromised" by thieves who then send fraudulent payment instructions through the SWIFT network - the same kind of messages used to steal Bangladesh Bank funds, the letter said without elaborating further.

On Monday, a top police investigator in Dhaka said that some Bangladesh central bank officials deliberately exposed its computer systems and enabled the theft.

He declined to identify those officials by name or say how many there were.

The comments by Mohammad Shah Alam, head of the Forensic Training Institute of the Bangladesh police's criminal investigation department, are the first sign that investigators have got a firm lead in one of the world's biggest cyber heists.

Arrests are likely soon, he said.