Article
The Lazarus Group: Espionage, Sabotage, and Cybercrime Under One Umbrella
Lazarus Group profile: active since at least 2009, with aliases and major incidents such as Sony Pictures, WannaCry and Bybit, plus defense guidance.
Read more
Significant cyber incident
Bangladesh Bank heist
In February 2016 attackers sent fraudulent payment instructions over the SWIFT network from Bangladesh Bank's account at the Federal Reserve Bank of New York.
In short
In February 2016 attackers sent fraudulent payment instructions over the SWIFT network from Bangladesh Bank's account at the Federal Reserve Bank of New York. According to the US Department of Justice complaint, the attempted theft approached 1 billion US dollars. About 81 million US dollars reached accounts in the Philippines, while a further 20 million US dollars sent to Sri Lanka was stopped by the receiving bank.
What happened
In February 2016 attackers sent fraudulent payment instructions over the SWIFT network from Bangladesh Bank’s account at the Federal Reserve Bank of New York. According to the US Department of Justice complaint, the attempted theft approached 1 billion US dollars. About 81 million US dollars reached accounts in the Philippines. A further 20 million US dollars sent to Sri Lanka was stopped by the receiving bank.
Timeline
-
October 2014
The US Department of Justice complaint says targeting of banks in Bangladesh had begun by 7 and 8 October 2014.
-
29 January 2015
One account sent 10 emails, posing as a job applicant, to 16 Bangladesh Bank employees, according to the complaint.
-
May 2015
Bank accounts were created in the Philippines in the names of fictitious persons. They later received the stolen money.
-
February 2016
Fraudulent payment instructions were sent over the SWIFT network from the bank's account at the Federal Reserve Bank of New York.
-
February 2016
About 81 million US dollars reached accounts in the Philippines. 20 million US dollars sent to Sri Lanka was stopped by the receiving bank.
-
9 March 2016
The New York Fed said there was no evidence that Federal Reserve systems were compromised.
-
10 May 2016
The New York Fed, Bangladesh Bank and SWIFT met in Basel to discuss the event.
-
23 June 2016
The New York Fed said it had enhanced monitoring for certain jurisdictions and transaction types.
-
8 June 2018
A federal arrest warrant was issued for Park Jin Hyok after a criminal complaint, according to the FBI wanted notice.
-
6 September 2018
The US Department of Justice made the charges public. OFAC sanctioned Park Jin Hyok and Chosun Expo.
-
1 February 2019
The New York Fed and Bangladesh Bank signed an agreement to help recover the stolen funds.
-
15 April 2020
US agencies issued an advisory on the North Korean cyber threat that names the Bangladesh Bank heist.
-
8 December 2020
A second federal arrest warrant was issued for Park Jin Hyok after further charges, according to the FBI wanted notice.
How the attack worked
Getting in
The US Department of Justice complaint (2018) says the attackers began with research. Their targeting of banks in Bangladesh began as early as 7 and 8 October 2014, more than a year before the theft. They then sent spear-phishing emails.
On 29 January 2015, one account sent 10 emails to 16 employees of Bangladesh Bank. The emails purportedly sought a job and linked to a file said to be a resume. The complaint says these links may have hosted the malware that gave first access. By 24 June 2015, another account held 37 Bangladesh Bank email addresses.
Reaching the payment terminals
The complaint says the attackers moved through the network to reach computers the bank used to send and receive SWIFT messages. From there they could impersonate staff who were allowed to create and send messages. The messages looked as if the bank had approved them.
Sending the instructions
The attackers crafted and sent real but fraudulent messages from the bank's own systems. Each one told the Federal Reserve Bank of New York to move money from Bangladesh Bank's US dollar account. The accounts that received the 81 million US dollars had been opened in the Philippines in May 2015, in the names of fictitious persons.
Hiding the activity
Banks normally keep a confirmation of each message and a database record of it. The complaint says the attackers used malware that interfered with both, then used other malware to delete the evidence of that interference.
Moving the money
The money that reached the Philippines was passed through several bank accounts, a money remitting business and casino junkets. The complaint says most of it has not been recovered.
Who was behind it
Attributed by the US Department of Justice: the complaint says the subjects are members of the group known as the Lazarus Group, and charges a North Korean programmer, Park Jin Hyok, who worked for Chosun Expo, a North Korean government front company. The US Treasury (OFAC) sanctioned Park and Chosun Expo on 6 September 2018 and also attributed the Bangladesh Bank transfer to the same conspiracy.
Who says who was behind it
Who attributed it, and how firm it is
The United States Department of Justice charged a North Korean programmer in 2018 and linked the theft to the Lazarus Group.
Impact
About 81 million US dollars was stolen and sent to accounts in the Philippines. The US Department of Justice complaint says it was then laundered through bank accounts, a money remitting business and casino junkets, and that the majority has not been recovered. Another 20 million US dollars sent to Sri Lanka was stopped by the receiving bank. The New York Fed said its own systems were not breached.
Government and regulator response
- 9 March 2016: the New York Fed said there was no evidence of any attempt to penetrate Federal Reserve systems. It said the instructions were fully authenticated by the SWIFT system under standard protocols.
- February 2016: the receiving bank in Sri Lanka stopped the 20 million US dollars sent there.
- 10 May 2016: the New York Fed, Bangladesh Bank and SWIFT met in Basel. They agreed to work to recover the proceeds, bring the perpetrators to justice and protect the global financial system from such attacks.
- 23 June 2016: the New York Fed said the incident was not caused by a breach of its systems. It said it had enhanced monitoring for certain jurisdictions and transaction types.
- 6 September 2018: the US Department of Justice unsealed criminal charges against Park Jin Hyok, and OFAC sanctioned him and Chosun Expo under Executive Order 13722.
- 1 February 2019: the New York Fed and Bangladesh Bank signed a Resolution and Assistance Agreement. The New York Fed gives technical help to Bangladesh Bank in its litigation to recover the stolen funds.
- 15 April 2020: the US State, Treasury and Homeland Security departments and the FBI issued an advisory on the North Korean cyber threat, with steps for financial institutions.
Lessons
-
Protect the systems that send payment messages
Treat the connection to the payment network as a critical system, with its own access controls and monitoring.
-
Check unusual payment instructions
Instructions that are out of pattern should be confirmed before they are released.
What to check in your own organization
-
Separate the payment message systems
The attackers moved through the bank network to reach the computers that send SWIFT messages. The 2020 US advisory lists network segmentation as a step for financial institutions. Check which staff and systems can reach these computers.
-
Train staff on job-application emails
The first contact was an email asking for a job, with a link to a resume. Train staff, especially in finance and IT, to treat unexpected resume links as suspect.
-
Confirm messages against an independent record
The attackers interfered with payment confirmations and database records. Check that confirmations and message records are kept where an attacker on the payment terminal cannot change them.
-
Watch for deleted evidence
The complaint says malware was used to delete traces of the tampering. Alert on removed logs or files on payment systems.
-
Review new beneficiary accounts
The receiving accounts were opened in May 2015, in the names of fictitious persons. Check new or unusual beneficiary accounts before large transfers are released.
-
Plan the response and report early
The 2020 advisory advises incident response plans and says timely notice to law enforcement can improve the chance of recovering stolen assets. Test that plan.
Where it happened
Questions
What was the Bangladesh Bank heist?
In February 2016 attackers sent fraudulent SWIFT payment instructions from Bangladesh Bank's account at the Federal Reserve Bank of New York. About 81 million US dollars reached accounts in the Philippines. The US Department of Justice complaint says the attempted theft approached 1 billion US dollars.
Was the Federal Reserve hacked?
No. The New York Fed said there was no evidence of an attempt to penetrate Federal Reserve systems, and that the incident was not caused by a breach of its systems. It said the instructions were fully authenticated by SWIFT.
Who was behind it?
Attributed by the US Department of Justice: a North Korean programmer, Park Jin Hyok, was charged in 2018 as part of a conspiracy the complaint links to the Lazarus Group. The US Treasury sanctioned him and his employer, Chosun Expo, on 6 September 2018.
Was the money recovered?
Not most of it. The 20 million US dollars sent to Sri Lanka was stopped. The complaint says the majority of the 81 million US dollars sent to the Philippines has not been recovered. The New York Fed and Bangladesh Bank signed an agreement in 2019 to pursue recovery.
How did the attackers get in?
The complaint says they sent spear-phishing emails to Bangladesh Bank staff, posing as a job applicant. They then moved through the network to the computers used to send SWIFT messages.
In our research
- The Lazarus Group: Espionage, Sabotage, and Cybercrime Under One Umbrella October 2025
- Perspective of the Month | APT Groups May 2023
- Lazarus APT Group (APT38) August 2022
- Lazarus Group Threat group
- Financial services Industry
Sources
- Criminal complaint, United States v. Park Jin Hyok (unsealed 6 September 2018) US Department of Justice
- Treasury Targets North Korea for Multiple Cyber-Attacks US Department of the Treasury (OFAC)
- Park Jin Hyok wanted notice FBI
- Guidance on the North Korean Cyber Threat US Departments of State, Treasury and Homeland Security and the FBI
- Statement on Media Reports About Bangladesh (9 March 2016) Federal Reserve Bank of New York
- Joint Statement: New York Fed, Bangladesh Bank and SWIFT Basel Meeting (10 May 2016) Federal Reserve Bank of New York
- Statement Regarding Cyber Efforts (23 June 2016) Federal Reserve Bank of New York
- Joint Statement: New York Fed and Bangladesh Bank (1 February 2019) Federal Reserve Bank of New York
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.