SWIFT attackers’ malware linked to more financial attacks

Symantec reports that a group responsible for the $81M Bangladesh central bank theft and other SWIFT-related frauds deployed malware (Backdoor.Fimlis, Backdoor.Fimlis.B, Backdoor.Contopee and Trojan.Banswift) against banks in Southeast Asia and Ecuador; code similarities — including a distinctive multi-iteration file-wiping routine and shared control bytes — link these tools to each other and to malware historically attributed to the Lazarus threat group, indicating a wider, ongoing financially motivated campaign targeting banks and payment systems.