Cybersecurity giant Symantec Corp. (SYMC) announced Tuesday that a second hacking group has launched a mission to rob banks using fraudulent messages on the financial messaging platform SWIFT, reports Reuters. The group, dubbed “Odinaff,” has used the same approach that yielded $81 million from an attack earlier this year on the central bank of Bangladesh. (See also: Investors Rally to Cybersecurity.)

Using Malware to Hack SWIFT

The Mountain View, Calif.-based company said the new hackers have infected 10 to 20 of its customers with malware that can be used to hide fraudulent transfer request on SWIFT, a financial messaging service used globally by moe than 11,000 financial institutions in more than 200 countries and territories.

Last Month, SWIFT CEO Gottfried Leibbrandt disclosed information on three hacks and warned of an upcoming surge in cyberattacks on banks. SWIFT and Symantec have not given details to the public about targets beyond the Bangladesh Bank, but they point to the United States, Hong Kong, Australia, the United Kingdom and Ukraine as major hubs for Odinaff attacks.

Banks Become Cybercrime Targets

The news indicates a surge in recent cybercrime, particularly in the financial sector, and a subsequent, revitalized need for next-gen cybersecurity. While Lazarus—the hacker group allegedly behind the Bangladesh heist and the 2014 hack of Sony Pictures Entertainment—has been linked to North Korea, Odinaff appears to be a financially motivated criminal group unaffiliated with a nation state.

“The discovery of Odinaff indicates that banks are at a growing risk of attack. Over the past few years, cybercriminals have begun to display a deep understanding of the internal financial systems used by banks. They have learned that banks employ a diverse range of systems and have invested time in finding out how they work and how employees operate them. When coupled with the high level of technical expertise available to some groups, these groups now pose a significant threat to any organization they target,” Symantec stated in a company release on Tuesday. (See also: Cybercrime Pays for Tech Investors.)</s>(Reuters) - Cyber-security firm Symantec Corp said on Tuesday that a second hacking group has sought to rob banks using fraudulent SWIFT messages, the same approach that yielded $81 million in the high-profile February attack on Bangladesh’s central bank.

Swift code bank logo is displayed on an iPhone 6s on top of Euro banknotes in this picture illustration, January 26, 2016. REUTERS/Dado Ruvic/Illustration/File Photo

Symantec said that a group dubbed Odinaff has infected 10 to 20 organizations with malware that can be used to hide fraudulent transfer requests made over SWIFT, the messaging system that is a lynchpin of the global financial system.

Symantec’s research provided new insight into ongoing hacking that has previously been disclosed by SWIFT. SWIFT Chief Executive Gottfried Leibbrandt last month told customers about three hacks and warned that cyber attacks on banks are poised to rise.

SWIFT and Symantec have not identified specific victims beyond Bangladesh Bank. Symantec said that most Odinaff attacks occurred in the United States, Hong Kong, Australia, the United Kingdom and Ukraine.

Symantec said it would share technical information about Odinaff with banks, governments and other security firms.

The company in May said it believed the Bangladesh heist was carried out by a group known as Lazarus, which was also responsible for attacks on SWIFT customers in Southeast Asia as well as the 2014 hack of Sony Pictures Entertainment.

The U.S. government has blamed North Korea for the Sony attack.

Symantec researcher Eric Chien said his firm has not confirmed that North Korea was behind Lazarus, but that the high level of sophistication of its work suggests involvement by a nation state.

Odinaff, on the other hand, appears to be a financially motivated criminal group, not a nation state, he added.

SWIFT spokeswoman Natasha de Terán said that the messaging cooperative’s customer security intelligence team had sent a warning about Odinaff’s activities to its members in the early summer.

That warning included technical indicators to help thwart potential attacks and a description of the group’s habits, Terán said.

Symantec said it believed that Odinaff is linked to Carbanak, a hacking group that has been targeting banks and merchant point-of-sale systems since at least 2014.

The two groups employ similar tactics in carrying out attacks and have used the same IP addresses to connect to their servers, according to Symantec.

(This version of the story corrects to make clear that 10 to 20 organizations were infected with Odinaff and not all of them were Symantec customers in the second paragraph)</s>Cyber-security firm Symantec Corp. said on Tuesday that a second hacking group has sought to rob banks using fraudulent SWIFT messages, the same approach that yielded $81-million in the high-profile February attack on Bangladesh’s central bank.

Symantec said that a group dubbed Odinaff has infected 10 to 20 organizations with malware that can be used to hide fraudulent transfer requests made over SWIFT, the messaging system that is a lynchpin of the global financial system.

Symantec’s research provided new insight into ongoing hacking that has previously been disclosed by SWIFT. SWIFT chief executive Gottfried Leibbrandt last month told customers about three hacks and warned that cyber attacks on banks are poised to rise.

SWIFT and Symantec have not identified specific victims beyond Bangladesh Bank. Symantec said that most Odinaff attacks occurred in the United States, Hong Kong, Australia, the United Kingdom and Ukraine.

Symantec said it would share technical information about Odinaff with banks, governments and other security firms.

The company in May said it believed the Bangladesh heist was carried out by a group known as Lazarus, which was also responsible for attacks on SWIFT customers in Southeast Asia as well as the 2014 hack of Sony Pictures Entertainment.

Symantec researcher Eric Chien said his firm has not confirmed that North Korea was behind Lazarus, but that the high level of sophistication of its work suggests involvement by not a nation state, he added.

Symantec said it believed that Odinaff is linked to Carbanak, a hacking group that has been targeting banks and merchant point-of-sale systems since at least 2014.</s>Symantec said that a group dubbed Odinaff has infected 10 to 20 organizations with malware that can be used to hide fraudulent transfer requests made over SWIFT, the messaging system that is a lynchpin of the global financial system.

Symantec's research provided new insight into ongoing hacking that has previously been disclosed by SWIFT. SWIFT Chief Executive Gottfried Leibbrandt last month told customers about three hacks and warned that cyber attacks on banks are poised to rise.

SWIFT and Symantec have not identified specific victims beyond Bangladesh Bank. Symantec said that most Odinaff attacks occurred in the United States, Hong Kong, Australia, the United Kingdom and Ukraine.

Symantec said it would share technical information about Odinaff with banks, governments and other security firms.

The company in May said it believed the Bangladesh heist was carried out by a group known as Lazarus, which was also responsible for attacks on SWIFT customers in Southeast Asia as well as the 2014 hack of Sony Pictures Entertainment.

The U.S. government has blamed North Korea for the Sony attack.

Symantec researcher Eric Chien said his firm has not confirmed that North Korea was behind Lazarus, but that the high level of sophistication of its work suggests involvement by a nation state.

Odinaff, on the other hand, appears to be a financially motivated criminal group, not a nation state, he added.

SWIFT spokeswoman Natasha de Terán said that the messaging cooperative's customer security intelligence team had sent a warning about Odinaff's activities to its members in the early summer.

That warning included technical indicators to help thwart potential attacks and a description of the group's habits, Terán said.

Symantec said it believed that Odinaff is linked to Carbanak, a hacking group that has been targeting banks and merchant point-of-sale systems since at least 2014.

The two groups employ similar tactics in carrying out attacks and have used the same IP addresses to connect to their servers, according to Symantec.
Computer security firm Symantec warns a second hacking group, going by the name Odinaff, is trying to rob banks using fraudulent SWIFT messages, the same approach that yielded U.S.$81 million in February's attack on Bangladesh's central bank. So far, the group has infected 10 to 20 organizations with this malware.