(Photo: Shutterstock)

North Korean cybercriminals were behind one of the biggest bank heists in modern history. Only they didn't use firearms or force to steal bank funds. They used emails.

A criminal complaint filed by the U.S. Department of Justice in June 2018 and made public in September 2018 charged North Korean national Park Jin Hyok, who was part of the North Korea-sponsored hacking team called the “Lazarus Group,” in connection with the 2014 cyberattack on Sony and the 2017 WannaCry ransomware. It also tied Park and his team to the unprecedented 2016 theft of $81 million from a Bangladesh bank.

In meticulous technical detail, the complaint described how the cybercriminals were able to successfully steal tens of millions of dollars from the bank without being detected. Such an inside view of the cyber heist also provided unparalleled insight into how enterprises become compromised and how they can protect themselves from such threats in the future.

According to the complaint, the theft of $81 million was surreptitiously routed to bank accounts in the Philippines before being laundered through additional worldwide accounts. The theft occurred in February 2016, but the actual heist had begun much earlier, in October 2014, when cybercriminals tied to North Korea started sending out phishing emails to various banks in Bangladesh.

The emails sent from multiple email addresses were nearly identical. All purported to come from a man named “Rasel Ahlam,” a supposed job applicant who was hoping for an opportunity for a personal interview.

Attached to all emails was a link to a .zip file pretending to contain a résumé. In reality, it contained a link to malware that would automatically download to the recipient's computer and, subsequently, to their bank's computer network.

According to the complaint, which cites FBI forensic analysis, in early 2015 the cyberattackers “were successful in causing recipients” at the one Bangladesh bank to “download the payload from their spear-phishing emails.” While the complaint does not state what the payload was, it does note the hackers were able to install a backdoor—a malware that allows ongoing access to a compromised network—on the bank's IT systems.

Once inside, the hackers impersonated bank employees to access an internal application connected to the Society for Worldwide Interbank Financial Telecommunication (SWIFT) network, which supports financial transactions between worldwide financial institutions.

The hackers then sent messages through SWIFT to the Federal Reserve Bank of New York, directing them to transfer funds from the Bangladesh bank's account to bank accounts in the Philippines. Afterward, the cybercriminals carefully covered their tracks, using another malware tool to prevent the generation of automatic SWIFT-related confirmations at the Bangladesh bank that would have alerted the staff to the fraudulent transfers.

While hijacking the SWIFT network took some expertise, getting into the bank's systems in the first place was a straightforward affair.

Indeed, while a simple and conventional hacking tool used to gain access to secure networks, phishing emails can be devastatingly effective. “Phishing is a horrendous problem, and it is a worldwide problem,” said Adam Levin, chairman and founder of identity and data protection company CyberScout.

Oftentimes, protecting against phishing emails is the first and best chance organizations has at ensuring their networks are safe. “Obviously it would be best if you could stop them at the perimeter—it's like if the moat worked for the castle,” Levin said.

But in order for a moat to work, organizations must approach cybersecurity in a holistic fashion. “It's one thing to throw money at technology; it's another thing to dedicate time and resources to employee training and to shifting the culture of the organization, not only in terms of people being aware of the threats but being aware of the kinds of phishing attacks” occurring today, Levin explained.

Still, investing in cybersecurity technology is important also for preventing the type of cyberattack that plagued the Bangladesh bank. Levin noted that protecting sensitive systems with proactive actions like two-factor authentication can limit the damage cyberattackers can do inside one's network.

“It's about layering your security … and having guards at the ready in the form of technology at different points of vulnerability,” he said.

To be sure, the North Korean cyberattackers targeted other financial institutions in addition to the Bangladesh bank. According to the complaint, the FBI was able to corroborate findings from the Russian cybersecurity company Group-IB, which linked North Korean cybercriminals to an early 2017 cyberattack on multiple banks in Poland.

In that situation, cybercriminals were able to infiltrate banks by using a “watering hole attack” by infecting the website of the Polish Financial Supervision Authority with malware, which then in turn infected any visitors to the site.

The complaint noted that additional watering hole attacks were executed against a bank in Mexico and one in South America and that both attacks had technical similarities to the ones in Poland.

While menacing, such attacks are a less common threat to today's enterprises. Migo Kedem, director of product management at cybersecurity company SentinelOne, noted that “watering hole attacks are more rare than spearphishing attacks, simply because they require exploits which are much more difficult to use.”

What's more, today's cybersecurity solutions will likely be able to detect malware on a website and prevent the user from accessing the site, he added.

Should companies get infected by malware in watering hole attacks, however, Levin said that layering one's security and limiting how much access each computer or mobile phone has to a network could prevent the malware from spreading. But he added that, when cyberattackers move to target various interconnected parts of the financial industry, what is also needed is industrywide cybersecurity cooperation.

“This is why there must be greater sharing of treat risk assessment,” he said. “It's an ecosystem, and everybody is part of that ecosystem.”