(Reuters) - Cyber-security firm Symantec Corp said on Tuesday that a second hacking group has sought to rob banks using fraudulent SWIFT messages, the same approach that yielded $81 million in the high-profile February attack on Bangladesh’s central bank. Using Malware to Hack SWIFT

The Mountain View, Calif.-based company said the new hackers have infected 10 to 20 of its customers with malware that can be used to hide fraudulent transfer request on SWIFT, a financial messaging service used globally by moe than 11,000 financial institutions in more than 200 countries and territories. Symantec’s research provided new insight into ongoing hacking that has previously been disclosed by SWIFT. SWIFT chief executive Gottfried Leibbrandt last month told customers about three hacks and warned that cyber attacks on banks are poised to rise. SWIFT and Symantec have not identified specific victims beyond Bangladesh Bank. SWIFT and Symantec have not given details to the public about targets beyond the Bangladesh Bank, but they point to the United States, Hong Kong, Australia, the United Kingdom and Ukraine as major hubs for Odinaff attacks. Symantec said it would share technical information about Odinaff with banks, governments and other security firms. While Lazarus—the hacker group allegedly behind the Bangladesh heist and the 2014 hack of Sony Pictures Entertainment—has been linked to North Korea, Odinaff appears to be a financially motivated criminal group unaffiliated with a nation state. Symantec researcher Eric Chien said his firm has not confirmed that North Korea was behind Lazarus, but that the high level of sophistication of its work suggests involvement by not a nation state, he added. Symantec said it believed that Odinaff is linked to Carbanak, a hacking group that has been targeting banks and merchant point-of-sale systems since at least 2014.
Computer security firm Symantec warns a second hacking group, going by the name Odinaff, is trying to rob banks using fraudulent SWIFT messages, the same approach that yielded U.S.$81 million in February's attack on Bangladesh's central bank. So far, the group has infected 10 to 20 organizations with this malware.