E-Financial
Kaspersky Exposes How Hackers ‘Lazarus Group’ Terrorise Banks
The results of its more-than-year-long investigation into the activity of ‘Lazarus’, a notorious hacking group allegedly responsible for the theft of 81 million dollars from the Central Bank of Bangladesh in 2016 has been disclosed by Kaspersky Lab.
During the forensic analysis of artefacts left by the group in South-East Asian and European banks, Kaspersky Lab has reached a deep understanding of what malicious tools the group uses and how it operates while attacking financial institutions, casinos, software developers for investment companies and crypto-currency businesses around the world.
This knowledge has helped to interrupt at least two other operations which had one goal – to steal a large amount of money from financial institutions.
In February 2016, a group of hackers (unidentified at that time) attempted to steal $851 million USD, and managed to transfer 81 million USD from the Central Bank of Bangladesh. This is considered to be one of the largest, most successful cyber heists ever.
Further investigation conducted by researchers from different IT security companies including Kaspersky Lab revealed a high chance that the attacks were conducted by Lazarus – a notorious cyber espionage and sabotage group responsible for a series of regular and devastating attacks, and known for attacking manufacturing companies, media and financial institutions in at least 18 countries around the world since 2009.
Although several months of silence followed the Bangladesh attack, the Lazarus group was still active. They had been preparing for a new operation to steal money from other banks and, by the time they were ready, they already had their foot in a financial institution in South East Asia. After being interrupted by Kaspersky Lab products and the following investigation, they were set back for another few months, and later decided to change their operation by moving to Europe. But here too, their attempts were interrupted by Kaspersky Lab’s security software detections, as well as the quick incident response, forensic analysis, and reverse engineering with support from company’s top researchers.
Lazarus Formula
Based on the results of the forensic analysis of these attacks, Kaspersky Lab researchers were able to reconstruct the modus operandi of the group.
Initial compromise: A single system inside a bank is breached either with remotely accessible vulnerable code (i.e. on a webserver) or through a watering hole attack through an exploit planted on a benign website. Once such a site is visited, the victim’s (bank employee) computer gets malware, which brings additional components.
Foothold established: Then the group migrates to other bank hosts and deploys persistent backdoors – the malware allows them to come and go whenever they want.
Internal reconnaissance: Subsequently the group spends days and weeks learning the network, and identifying valuable resources. One such resource may be a backup server, where authentication information is stored, a mail server or the whole domain controller with keys to every “door” in the company, as well as servers storing or processing records of financial transactions.
Deliver and steal: Finally, they deploy special malware capable of bypassing the internal security features of financial software and issuing rogue transactions on behalf of the bank.
Geography and Attribution
The attacks investigated by Kaspersky Lab researchers lasted for weeks. However, the attackers could operate under the radar for months.
For example, during the analysis of the incident in South-East Asia, experts discovered that hackers were able to compromise the bank network no less than seven months prior to the day when the bank’s security team requested incident response. In fact, the group had access to the network of that bank even before the day of the Bangladesh incident.
According to Kaspersky Lab records, from December 2015, malware samples relating to Lazarus group activity appeared in financial institutions, casinos software developers for investment companies and crypto-currency businesses in Korea, Bangladesh, India, Vietnam, Indonesia, Costa Rica, Malaysia, Poland, Iraq, Ethiopia, Kenya, Nigeria, Uruguay, Gabon, Thailand and several other countries.
The latest samples known to Kaspersky Lab were detected in March 2017, showing that attackers have no intention of stopping.
Even though attackers were careful enough to wipe their traces, at least one server they breached for another campaign contained a serious mistake with an important artefact being left behind. In preparation for operation, the server was configured as the command & control center for the malware.
The first connections made on the day of configuration were coming from a few VPN/proxy servers indicating a testing period for the C&C server. However, there was one short connection on that day which was coming from a very rare IP address range in North Korea.
According to researchers, that could mean several things:
The attackers connected from that IP address in North Korea.
It was someone else’s carefully planned false flag operation.
Someone in North Korea accidentally visited the command and control URL.
The Lazarus group heavily invests in new variants of their malware. For months they were trying to create a malicious toolset which would be invisible to security solutions, but every time they did this, Kaspersky Lab’s specialists managed to identify unique features in how they create their code, allowing Kaspersky Lab to keep tracking the new samples. Now, the attackers have gone relatively quiet, which probably means that they have paused to rework their arsenal.
“We’re sure they’ll come back soon. In all, attacks like the ones conducted by Lazarus group show that a minor misconfiguration may result in a major security breach, which can potentially cost a targeted business hundreds of millions of dollars in loss. We hope that chief executives from banks, casinos and investment companies around the world will become wary of the name Lazarus,” said Vitaly Kamluk, Head of Global Research and Analysis Team APAC at Kaspersky Lab.
The company is also releasing crucial Indicators of Compromise (IOC) and other data to help organisations search for traces of these attack groups in their corporate networks.
“We urge all organisations to carefully scan their networks for the presence of Lazarus malware samples and, if detected, to disinfect their systems and report the intrusion to law enforcement and incident response teams”, added Vitaly Kamluk.
Building on the successful conclusion of the 17th replenishment of the African Development Fund (ADF-17), which mobilised $11 billion for Africa’s most vulnerable countries, the African Development Bank Group and the Government of the United Kingdom convened global investors and private sector leaders in London to accelerate a new phase of private capital mobilisation for Africa’s development.
The inaugural Africa Private Capital Mobilisation Day, held on 17 December at Lancaster House, brought together more than 150 senior decision-makers from private equity firms, sovereign wealth funds, pension funds, insurers, philanthropies, and development finance institutions and export credit agencies—marking a decisive shift from dialogue to execution.
The high-level event was hosted by the African Development Bank Group in partnership with UK government institutions, the Foreign Commonwealth and Development Office, UK Export Finance and British International Investment, reflecting a shared ambition to scale private capital flows into African economies.
Speaking at the opening, African Development Bank Group President Dr Sidi Ould Tah described the event as a natural continuation of the ADF-17 replenishment process and a decisive step toward addressing Africa’s estimated $402 billion annual development financing gap.
“We will build on recent engagements with development finance institutions, export credit agencies, pension funds, sovereign wealth funds, insurers, and philanthropic partners to advance concrete initiatives under our vision for a New African Financial Architecture,” said Dr Ould Tah.
The Africa Private Capital Mobilisation Day aligns with President Ould Tah’s Four Cardinal Points vision, which focuses on unlocking Africa’s capital potential, strengthening financial sovereignty, transforming demographic growth into a dividend, and delivering resilient infrastructure and value chains.
UK Minister for Development, Jenny Chapman said, “We are delighted that President Ould Tah decided to hold the first Private Capital Mobilisation Day here in London, recognising the critical role of the City of London in mobilising investment for Africa. The UK’s shifting role—from donor to investor—will support countries who want to grow their economies and ultimately ultimately exit the need for aid.”
The programme featured focused discussions on reshaping perceptions of risk in Africa, designing innovative financial platforms, and mobilising capital in fragile and frontier markets.
New analysis on the Global Emerging Markets Risk Database delivered by the Center for Global Development presented new evidence showing that long-term lending to African borrowers has historically been significantly less risky than commonly perceived.
Sector-focused discussions underscored the strategic role of healthcare and aviation in strengthening Africa’s economic resilience, productivity and integration. Participants were introduced to two flagship initiatives championed by the Bank Group and its partners:
– The Africa Medicines and Equipment Facility, developed in partnership with the Gates Foundation, will provide African countries with predictable, timely, and affordable financing to secure essential medicines and medical equipment.
– The Integrated Aviation Transformation Programme for Africa—supported by a dedicated blended-finance facility—aims to modernise and expand Africa’s aviation ecosystem—from airports and airlines to enabling services critical to trade, tourism, and regional integration.
In parallel, President Ould Tah convened a closed-door roundtable with senior executives from approximately 30 leading institutional investors to explore the launch of an Africa-focused Private Sector Innovation Lab. The proposed platform would serve as a dedicated space to co-create new financing instruments, partnership models, and risk-sharing solutions tailored to African markets.
The outcomes of the Africa Private Capital Mobilisation Day are captured in the London Communiqué, setting out clear commitments by the African Development Bank Group and its partners to scale private capital mobilisation for Africa.
Further work will go into setting out priority actions and implementation pathways to scale private capital mobilisation for Africa, turning ambition into scalable capital and risk mitigation solutions.
The Federal Inland Revenue Service (FIRS) has announced that the National Identification Number (NIN) will automatically serve as the Tax Identification Number (TIN) for individual Nigerians beginning in 2026.
The clarification was issued on Monday through a public awareness campaign on the new tax laws shared by the Service on X.
According to the FIRS, registered businesses will also no longer need a separate Tax Identification Number, as their Corporate Affairs Commission (CAC) registration numbers will now function as their official tax identifiers under the revised tax framework.
The announcement follows public concerns over aspects of the new tax laws that require a Tax ID for certain transactions, including the operation and ownership of bank accounts.
Providing further explanation, the FIRS said the Nigeria Tax Administration Act (NTAA), scheduled to take effect in January 2026, mandates the use of a Tax ID for specified transactions. It, however, noted that the requirement is not entirely new, stressing that it has been in existence since the Finance Act of 2019 but has now been strengthened.
“The Tax ID unifies all Tax Identification Numbers previously issued by the FIRS and State Internal Revenue Services into a single identifier,” the Service said.
“For individuals, your NIN automatically serves as your Tax ID, while for registered companies, your CAC RC number is used. You do not need a physical card, as the Tax ID is a unique number linked directly to your identity.”
The FIRS explained that the new system is intended to simplify identification processes, eliminate duplication, close gaps that enable tax evasion, and promote fairness by ensuring that all individuals earning taxable income contribute accordingly.
The agency also urged Nigerians to ignore misinformation surrounding the reform, assuring the public that the new tax framework is designed to improve efficiency and transparency in tax administration.
Meanwhile, the Chairman of the Presidential Committee on Fiscal Policy and Tax Reforms, Taiwo Oyedele, disclosed that banks will be required to request a TIN from all taxable Nigerians as part of the federal government’s new tax administration framework, which will take effect on January 1, 2026.
Fidelity Bank Plc has reinforced its commitment to community safety and sustainable ecological practices through the donation of essential firefighting and preventive equipment including hoses and gasoline water pumps to the Ikoyi Fire Service Station in Lagos.
L-R: Lagos State Controller, Federal Fire Service, CF (Controller of Fire), Adebayo Funke; Tolulope Rojaiye, Marketing Business Partner, Fidelity Bank Plc; Assistant Superintendent of Fire, Ishola Folorunsho Olufemi; and Station Commander, Onikan Fire Station, Lagos, Okeke Ferdinand; during the donation of firefighting equipment to the Federal Fire Service at Ikoyi, Lagos, recently.
The donation was made under the Fidelity Helping Hands Program (FHHP) by the True Serve team, reaffirming the Bank’s commitment to the environment and community safety. Through the FHHP, members of staff identify areas of critical community needs, raise funds, and then receive matching monetary support from the bank to execute the projects.
Commenting on the reason behind the donation, Divisional Head, Brand and Communications Division, Fidelity Bank Plc, Dr Meksley Nwagboh, emphasized that the donation reflects the bank’s dedication to strengthening emergency response capabilities and promoting public safety within the communities it serves.
According to him, “Fidelity Bank remains committed to supporting initiatives that contribute to the protection of our environment, lives and property. We see community safety as a shared responsibility and continuously extend support to both corporate bodies and individuals.”
Dr Nwagboh further noted that, “We believe that preventive measures are far more effective than reactionary responses. This donation is part of our efforts to drive sustainable practices by providing the necessary tools. Our goal is to ensure that people live meaningful, safe, and empowered lives.”
In her comments, Lagos State Controller, Federal Fire Service and Controller of Fire (CF), Funke Adebayo commended Fidelity Bank for the timely support, while cautioning residents to exercise heightened vigilance during the festive period, especially with the dry weather conditions.
“We appreciate Fidelity Bank for this timely donation. We are in a harsh weather period where fire incidents can escalate quickly. Parents must educate and caution children against the use of fireworks during celebrations. Fire should never be treated carelessly,” Adebayo said.
She noted that the Fire Service has embarked on sensitization visits to various corporate organizations, warning against unsafe practices that could lead to preventable fire outbreaks.
On his part, Area Commander, Onikan Fire Station and Chief Superintendent of Fire (CSF)Oswere Michael expressed appreciation to Fidelity Bank for supporting their operations. He encouraged families, business owners, and community members to prioritize fire safety at all times.
“Everyone has a role to play in preventing fire incidents at home and in the workplace. This support from Fidelity Bank will go a long way in enhancing our capacity to protect the community,” CSF Oswere added.
Ranked among the best banks in Nigeria, Fidelity Bank Plc is a full-fledged Commercial Deposit Money Bank serving over 9.1 million customers through digital banking channels, its 255 business offices in Nigeria and United Kingdom subsidiary, FidBank UK Limited.
The Bank is a recipient of multiple local and international Awards, including the 2024 Excellence in Digital Transformation & MSME Banking Award by BusinessDay Banks and Financial Institutions (BAFI) Awards; the 2024 Most Innovative Mobile Banking Application award for its Fidelity Mobile App by Global Business Outlook, and the 2024 Most Innovative Investment Banking Service Provider award by Global Brands Magazine. Additionally, the Bank was recognized as the Best Bank for SMEs in Nigeria by the Euromoney Awards for Excellence and as the Export Financing Bank of the Year by the BusinessDay Banks and Financial Institutions (BAFI) Awards.
Woherem Proposes Pragmatic Roadmap to End Terrorism and Banditry in Nigeria
AfDB Group Mobilises Global Private Capital to Close Africa’s Financing Gap
FIRS says NIN, CAC Numbers to Serve as Tax IDs from 2026
REDAN Seals Landmark MoU, Validates Sytemap’s Real Estate Infrastructure
Oyedele Dismisses Claims Bank Accounts Without TIN Will Be Frozen
Nigeria Records Highest Weekly Cyberattacks in Africa — Report
Cyber Tsunami Hits Nigeria as Breaches Surge 1,047%, esentry Q3 Report Reveals
Minister Claims Bandits Exploit Poor Network, Bounce Calls Off Multiple Towers
GenAI Adoption Among African workers Outpace Global Peers
Jumia’s Data Shows Nigerians Turning to Digital Retail to Navigate Inflation Pressures
News3 days agoUS Okays $2.1Bn for Christian Healthcare in Nigeria
General News3 days agoThe Mood Market to Light Up Lagos with a Rooftop Gifting, Food & Lifestyle Fair this Christmas
News3 days agoSERAP Asks Tinubu to Release CTC of Tax Bill
Broadcasting3 days agoTim Akano Recounts 20-Year Growth, Media Support at NITRA End-of-Year Meet
E-Financial3 days agoSterling Bank, Water.org, Sterling One Foundation Partner on WASH Loan for Millions
General News3 days agoLeo Stan Ekeh: A “Rare Avis”, an Unconquerable Entrepreneur
- News2 days ago
US Begins Partial Visa Ban on Nigerians January 1
General News3 days agoFCCPC Forces Ikeja Electric Into Compliance, Unseals Headquarters After Rights Breach