Malware suspected in Bangladesh bank heist

Investigators suspect that malicious software code, often referred to as malware, which allowed hackers to learn how to withdraw the money could have been installed several weeks before the incident, which took place between Feb 4 and Feb 5, said Bangladesh Bank officials briefed on the matter.

Investigators believe the attack was sophisticated, describing the use of a "zero day" and referring to an "advanced persistent threat," the officials said.

A zero day is a vulnerability in software that has yet to be identified or patched. This makes it easier for hackers to infect a targeted computer without the victim's knowledge, even if it is protected with security software.

Advanced persistent threat refers to long-term attacks where hackers remain inside a network for months or even years.

Security experts said they hope samples of the malware will be made available to researchers so they can determine whether they are truly advanced, or if Bangladesh Bank's security protections were not strong enough to block the attack.

"The next piece of the puzzle that will likely emerge is a sample of the malware and/or if a true zero-day vulnerability was used," said Jeff Wichman, a consultant with cyber security firm Optiv.

The Bangladesh Bank officials acknowledged weaknesses in their systems and said it could take two years or more to repair the problems.

Wichman said he suspects one of the tools was a customised version of a common piece of malware known as a Remote Access Trojan, or RAT, which gives attackers the ability to gain remote control of a victim's computer.

So far, investigators have not found any proof that central bank staff in Bangladesh were involved, one of the officials said, but said the probe was continuing.

Security experts say that if insiders were not involved, the attackers likely had assistance from somebody close to the banking industry. They also may have spied on bank workers over an extended period to gain details about wire-transfer processes and other operations, they said.

"It takes somebody with deep knowledge of the banking industry to perform these types of crime," said Shane Shook, a security consultant who has investigated some of the biggest cyber breaches on record.

The New York Fed, which provides banking services to some 250 central banks and other institutions, has said its systems were not compromised.

The Bangladesh central bank had billions of dollars in its current account, which it used for international settlements, officials have said.

The stolen money made its way to various parts of the world.

Some US$80 million are believed to have ended in the Philippines, and further diverted to casinos and then to Hong Kong, according to bank officials.

One US$20 million transaction was directed to a non-profit organisation in Sri Lanka.

But the unusually large transaction for the island nation and a misspelling of the NGO's name raised red flags that helped bring the robbery to light. The transaction was blocked as was another huge payment instruction that was for between US$850 million and US$870 million