E-Financial
Kaspersky Exposes How Hackers ‘Lazarus Group’ Terrorise Banks
The results of its more-than-year-long investigation into the activity of ‘Lazarus’, a notorious hacking group allegedly responsible for the theft of 81 million dollars from the Central Bank of Bangladesh in 2016 has been disclosed by Kaspersky Lab.
During the forensic analysis of artefacts left by the group in South-East Asian and European banks, Kaspersky Lab has reached a deep understanding of what malicious tools the group uses and how it operates while attacking financial institutions, casinos, software developers for investment companies and crypto-currency businesses around the world.
This knowledge has helped to interrupt at least two other operations which had one goal – to steal a large amount of money from financial institutions.
In February 2016, a group of hackers (unidentified at that time) attempted to steal $851 million USD, and managed to transfer 81 million USD from the Central Bank of Bangladesh. This is considered to be one of the largest, most successful cyber heists ever.
Further investigation conducted by researchers from different IT security companies including Kaspersky Lab revealed a high chance that the attacks were conducted by Lazarus – a notorious cyber espionage and sabotage group responsible for a series of regular and devastating attacks, and known for attacking manufacturing companies, media and financial institutions in at least 18 countries around the world since 2009.
Although several months of silence followed the Bangladesh attack, the Lazarus group was still active. They had been preparing for a new operation to steal money from other banks and, by the time they were ready, they already had their foot in a financial institution in South East Asia. After being interrupted by Kaspersky Lab products and the following investigation, they were set back for another few months, and later decided to change their operation by moving to Europe. But here too, their attempts were interrupted by Kaspersky Lab’s security software detections, as well as the quick incident response, forensic analysis, and reverse engineering with support from company’s top researchers.
Lazarus Formula
Based on the results of the forensic analysis of these attacks, Kaspersky Lab researchers were able to reconstruct the modus operandi of the group.
Initial compromise: A single system inside a bank is breached either with remotely accessible vulnerable code (i.e. on a webserver) or through a watering hole attack through an exploit planted on a benign website. Once such a site is visited, the victim’s (bank employee) computer gets malware, which brings additional components.
Foothold established: Then the group migrates to other bank hosts and deploys persistent backdoors – the malware allows them to come and go whenever they want.
Internal reconnaissance: Subsequently the group spends days and weeks learning the network, and identifying valuable resources. One such resource may be a backup server, where authentication information is stored, a mail server or the whole domain controller with keys to every “door” in the company, as well as servers storing or processing records of financial transactions.
Deliver and steal: Finally, they deploy special malware capable of bypassing the internal security features of financial software and issuing rogue transactions on behalf of the bank.
Geography and Attribution
The attacks investigated by Kaspersky Lab researchers lasted for weeks. However, the attackers could operate under the radar for months.
For example, during the analysis of the incident in South-East Asia, experts discovered that hackers were able to compromise the bank network no less than seven months prior to the day when the bank’s security team requested incident response. In fact, the group had access to the network of that bank even before the day of the Bangladesh incident.
According to Kaspersky Lab records, from December 2015, malware samples relating to Lazarus group activity appeared in financial institutions, casinos software developers for investment companies and crypto-currency businesses in Korea, Bangladesh, India, Vietnam, Indonesia, Costa Rica, Malaysia, Poland, Iraq, Ethiopia, Kenya, Nigeria, Uruguay, Gabon, Thailand and several other countries.
The latest samples known to Kaspersky Lab were detected in March 2017, showing that attackers have no intention of stopping.
Even though attackers were careful enough to wipe their traces, at least one server they breached for another campaign contained a serious mistake with an important artefact being left behind. In preparation for operation, the server was configured as the command & control center for the malware.
The first connections made on the day of configuration were coming from a few VPN/proxy servers indicating a testing period for the C&C server. However, there was one short connection on that day which was coming from a very rare IP address range in North Korea.
According to researchers, that could mean several things:
The attackers connected from that IP address in North Korea.
It was someone else’s carefully planned false flag operation.
Someone in North Korea accidentally visited the command and control URL.
The Lazarus group heavily invests in new variants of their malware. For months they were trying to create a malicious toolset which would be invisible to security solutions, but every time they did this, Kaspersky Lab’s specialists managed to identify unique features in how they create their code, allowing Kaspersky Lab to keep tracking the new samples. Now, the attackers have gone relatively quiet, which probably means that they have paused to rework their arsenal.
“We’re sure they’ll come back soon. In all, attacks like the ones conducted by Lazarus group show that a minor misconfiguration may result in a major security breach, which can potentially cost a targeted business hundreds of millions of dollars in loss. We hope that chief executives from banks, casinos and investment companies around the world will become wary of the name Lazarus,” said Vitaly Kamluk, Head of Global Research and Analysis Team APAC at Kaspersky Lab.
The company is also releasing crucial Indicators of Compromise (IOC) and other data to help organisations search for traces of these attack groups in their corporate networks.
“We urge all organisations to carefully scan their networks for the presence of Lazarus malware samples and, if detected, to disinfect their systems and report the intrusion to law enforcement and incident response teams”, added Vitaly Kamluk.
Nigeria Insurance Deposit Corporation (NDIC) has guaranteed customers of insured commercial banks prompt recovery of their deposits in the event of risk liability or liquidation.
In addition, the corporation assured depositors of its statutory mandate, which includes supervising banks for risk assessment, ensuring ethical standards, and enhancing financial stability in the country.
Mrs Emily Osuji, executive director, Corporate Services, NDIC, gave the assurance during a Stakeholders Town Hall Meeting on customer protection regarding bank charges and deposits in Kano.
Mrs Osuji posited that the NDIC has, in recent times, demonstrated a strong commitment to protecting the hard-earned savings of Nigerians and sustaining confidence in the banking system.
She cited the cases of defunct Heritage Bank Limited, Union Homes Plc and Aso Savings and Loans Plc, where depositors received their deposits promptly after meeting the relevant requirements.
The NDIC boss, however, reminded customers to link their Bank Verification Number (BVN) as a unique identifier to locate their alternate accounts, where their claims will be transferred.
The executive director affirmed that NDIC has expanded coverage to protect about 99 per cent of depositors in Nigeria, a deliberate policy aimed at protecting small savers, promoting financial inclusion, and enhancing trust in the banking sector.
She said, “The corporation fulfils its role through its core mandates of deposit guarantee, bank supervision, distress resolution and bank liquidation, all of which are geared towards protecting the hard-earned savings of Nigerians and sustaining confidence in the banking system.
“Our strapline, ‘Protecting your bank deposits!’, is more than mere words for us. We stand by this statement as a firm commitment to our mandate of ensuring that depositors have access to their hard-earned savings in the event of bank failure.
“This is a critical responsibility that we do not take lightly. This is especially so in times of financial uncertainty and distress, with the NDIC standing as a pillar of safety and reassurance for depositors, particularly the most vulnerable.”
Speaking on the concept of stakeholder engagement, Hawwau Gambo, head of Communication and Public Affairs, said the corporation was compelled to provide clarity, build trust and strengthen depositor confidence amid misconceptions.
Gambo noted that the recent revocation of the operating licences of some banks by the Central Bank of Nigeria, (CBN) and the current public discourse on banks’ recapitalisation efforts have reinforced the need for sustained stakeholder engagement.
She reminded that sustained awareness is pertinent to dust, given already heightened public interest and featured public confidence in the financial institutions.
“NDIC’s last Public Awareness Survey highlighted the need to enhance interpersonal communication channels to improve public understanding of deposit insurance. It is against this backdrop that the Stakeholders’ Town Hall Meetings were conceived as a structured, interactive platform for dialogue, education and feedback,” Gambo noted.
The Central Bank of Nigeria in its 2025 Fintech Policy Insight Report, has raised concern over Nigeria’s fintech sector heavily dependent on foreign investment, exposing it to swings in global markets.
The report said the sector has shown resilience despite global economic pressures, but warned that reliance on external capital leaves it vulnerable to market fluctuations.
It would be recalled that startups in the country raised $520m in equity funding in 2024, down from about $747m in 2019, when Nigeria captured roughly 37 per cent of all African startup investment.
This performance, amid significant global macroeconomic gyrations, underscores Nigeria’s position as a key hub for financial innovation. The sharp rise in interest rates in advanced economies during 2022 contributed to a slowdown in venture capital funding.
“These dynamics highlight the importance of developing domestic funding avenues, such as leveraging Nigeria’s capital markets, to reduce currency risk and sustain fintech growth,” the apex bank stated.
Olayemi Cardoso, CBN Governor, said Nigeria is undergoing a rapid and significant financial evolution. Over the past decade, the nation’s fintech landscape has grown from a handful of startups into one of Africa’s most vibrant innovation ecosystems.
“Even amid global economic headwinds, Nigerian fintech firms continued to attract investment and drive change. Today, with improved stability of our currency and domestic economy, it is clearer than ever that financial innovation can advance inclusion at scale,” the executive commented on the report.
In addition to funding, the central bank underscored Nigeria’s continued leadership in digital financial infrastructure. More than 25 per cent of all electronic transactions in Africa’s most populous nation are processed via real-time payment channels, with close to 11 billion transactions processed in 2024, up from five billion in 2022. The report described Nigeria’s instant payments platform, NIBSS NIP, as among the most mature and widely adopted globally.
The report also mentioned the need to strengthen system integrity and reputation, pointing to compliance reforms, anti-money laundering supervision, and consumer protection measures as key priorities for sustaining investor confidence.
By focusing on domestic funding, regulatory modernisation, and innovation infrastructure, the CBN aims to position Nigeria not only as a fintech front-runner but also as a rule-setter whose regulatory lessons are relevant to peer emerging and high-growth economies globally, the central bank said.
Stakeholders surveyed by the CBN also cited compliance costs as a significant challenge to innovation. According to the report, 87.5 per cent of respondents said that the cost of meeting regulatory and risk requirements significantly impacts their capacity to innovate, while delays in product approvals and regulatory timelines also remain major bottlenecks.
The report noted that 62.5 per cent of fintech firms plan to expand regionally, and there is strong support for regulatory pass-porting frameworks to enable compliant expansion into other African markets. However, the CBN warns that such cross-border growth requires a stable funding base and coordinated regulation.
After a few years abroad, I returned to Nigeria and faced a dilemma. Let me tell you all about it.
UBA
A few days ago, I was dragging my luggage through Murtala Muhammed International Airport. Everything felt bright and beautiful. Not necessarily in aesthetics, but in the vibrant colours, sounds, and energy all around. After three intensive years in the UK, I was finally back home. Ready for the hustle and bustle of Lagos life, and yes, the comfort of my parents’ home.
The plan was simple. Settle down and get my life on track. I’d sorted the job, and I had my person. But then came my dilemma. Money!. This doesn’t mean I was short of it or had too much of it. The real issue is where to actually keep and manage it in this country with daily dramatic happenings. With just two weeks left before I resumed at my new workplace, I had no time for long queues, endless paperwork, or the classic “Nigeria bank stress.” So, I needed an account, and I needed it fast.
So I turned to my best friend, Google, and typed, “Instant account opening in Nigeria.”
In less than a second, I was redirected to the United Bank for Africa instant account opening portal. A few taps later, and I had a fully functional account. Just like that. I could receive my funds, transfer my funds, and start building my financial life here again.
In less than a second, I was redirected to the United Bank for Africa instant account opening portal. A few taps later, and I had a fully functional account. Just like that. I could receive my funds, transfer my funds, and start building my financial life here again. Talk about ease, and this beautiful experience truly exemplified that definition
I was genuinely amazed. It felt too easy, almost suspiciously easy. But it was real, I mean, really soft like they were just thinking all about me while developing this new feature.
If you’re like me and pressed for time, avoiding unnecessary stress, or just ready to sort your finances without the hassle, consider this your sign.
UBA’s instant account opening is a game-changer. No queues to cut into your precious time. Just you and your phone, minutes away from being banked.
Get started here: https://aop.ubagroup.com
Trust me, if I could do it between unpacking and settling in, you can do it too. Your future self will thank you.
PalmPay Celebrates Valentine with #LoveWithPalmPay Campaign
CBN, NCC Propose Instant Refunds for Failed Airtime, Data
NDIC Says No Customer Loses Deposits in Failed Banks
NCC Begins Overhaul of Nigeria’s Telecom Policy, 26 Years After
FG Launches the Happy Woman App Platform
Firm Detected a Fivefold Surge in QR Code Phishing Attacks in the Second Half of 2025
US invests $115m in counter-drone tech for World Cup security
Nigerian Terra Industries Secures $11.8m for Expansion
Nigeria Targeted with 4,622 Cyber-attacks Per Week in December 2025
Firm Detected a Scam Exploiting OpenAI’s Teamwork Features
E-Financial3 days agoAlawuba Advocates Security, Bankable Projects, Infrastructure Development to Promote South-East Vision
Telecom2 days agoNCC Committed to Regional Digital Integration – Maida
General News2 days agoIndigenous Firm Deploys 400,000 Smart Electricity Meters in 2025
E-Financial2 days agoCBN Expresses Concern Over Foreign Investments in Nigeria Fintechs
E-Financial2 days agoBOI Secures CBN Nod for Sharia Banking, Unlocks Ethical Funding Boom
Telecom2 days agoITU Top Director Visits NITDA, Boosts Nigeria’s Digital Literacy Push
E-Financial2 days agoUBA’s Easy and Instant Account Opening Thrills Returnee
News2 days agoEFInA Unveils Research Fellowship Programme to Deepen Financial Inclusion Impact