E-Financial
Kaspersky Exposes How Hackers ‘Lazarus Group’ Terrorise Banks
The results of its more-than-year-long investigation into the activity of ‘Lazarus’, a notorious hacking group allegedly responsible for the theft of 81 million dollars from the Central Bank of Bangladesh in 2016 has been disclosed by Kaspersky Lab.
During the forensic analysis of artefacts left by the group in South-East Asian and European banks, Kaspersky Lab has reached a deep understanding of what malicious tools the group uses and how it operates while attacking financial institutions, casinos, software developers for investment companies and crypto-currency businesses around the world.
This knowledge has helped to interrupt at least two other operations which had one goal – to steal a large amount of money from financial institutions.
In February 2016, a group of hackers (unidentified at that time) attempted to steal $851 million USD, and managed to transfer 81 million USD from the Central Bank of Bangladesh. This is considered to be one of the largest, most successful cyber heists ever.
Further investigation conducted by researchers from different IT security companies including Kaspersky Lab revealed a high chance that the attacks were conducted by Lazarus – a notorious cyber espionage and sabotage group responsible for a series of regular and devastating attacks, and known for attacking manufacturing companies, media and financial institutions in at least 18 countries around the world since 2009.
Although several months of silence followed the Bangladesh attack, the Lazarus group was still active. They had been preparing for a new operation to steal money from other banks and, by the time they were ready, they already had their foot in a financial institution in South East Asia. After being interrupted by Kaspersky Lab products and the following investigation, they were set back for another few months, and later decided to change their operation by moving to Europe. But here too, their attempts were interrupted by Kaspersky Lab’s security software detections, as well as the quick incident response, forensic analysis, and reverse engineering with support from company’s top researchers.
Lazarus Formula
Based on the results of the forensic analysis of these attacks, Kaspersky Lab researchers were able to reconstruct the modus operandi of the group.
Initial compromise: A single system inside a bank is breached either with remotely accessible vulnerable code (i.e. on a webserver) or through a watering hole attack through an exploit planted on a benign website. Once such a site is visited, the victim’s (bank employee) computer gets malware, which brings additional components.
Foothold established: Then the group migrates to other bank hosts and deploys persistent backdoors – the malware allows them to come and go whenever they want.
Internal reconnaissance: Subsequently the group spends days and weeks learning the network, and identifying valuable resources. One such resource may be a backup server, where authentication information is stored, a mail server or the whole domain controller with keys to every “door” in the company, as well as servers storing or processing records of financial transactions.
Deliver and steal: Finally, they deploy special malware capable of bypassing the internal security features of financial software and issuing rogue transactions on behalf of the bank.
Geography and Attribution
The attacks investigated by Kaspersky Lab researchers lasted for weeks. However, the attackers could operate under the radar for months.
For example, during the analysis of the incident in South-East Asia, experts discovered that hackers were able to compromise the bank network no less than seven months prior to the day when the bank’s security team requested incident response. In fact, the group had access to the network of that bank even before the day of the Bangladesh incident.
According to Kaspersky Lab records, from December 2015, malware samples relating to Lazarus group activity appeared in financial institutions, casinos software developers for investment companies and crypto-currency businesses in Korea, Bangladesh, India, Vietnam, Indonesia, Costa Rica, Malaysia, Poland, Iraq, Ethiopia, Kenya, Nigeria, Uruguay, Gabon, Thailand and several other countries.
The latest samples known to Kaspersky Lab were detected in March 2017, showing that attackers have no intention of stopping.
Even though attackers were careful enough to wipe their traces, at least one server they breached for another campaign contained a serious mistake with an important artefact being left behind. In preparation for operation, the server was configured as the command & control center for the malware.
The first connections made on the day of configuration were coming from a few VPN/proxy servers indicating a testing period for the C&C server. However, there was one short connection on that day which was coming from a very rare IP address range in North Korea.
According to researchers, that could mean several things:
The attackers connected from that IP address in North Korea.
It was someone else’s carefully planned false flag operation.
Someone in North Korea accidentally visited the command and control URL.
The Lazarus group heavily invests in new variants of their malware. For months they were trying to create a malicious toolset which would be invisible to security solutions, but every time they did this, Kaspersky Lab’s specialists managed to identify unique features in how they create their code, allowing Kaspersky Lab to keep tracking the new samples. Now, the attackers have gone relatively quiet, which probably means that they have paused to rework their arsenal.
“We’re sure they’ll come back soon. In all, attacks like the ones conducted by Lazarus group show that a minor misconfiguration may result in a major security breach, which can potentially cost a targeted business hundreds of millions of dollars in loss. We hope that chief executives from banks, casinos and investment companies around the world will become wary of the name Lazarus,” said Vitaly Kamluk, Head of Global Research and Analysis Team APAC at Kaspersky Lab.
The company is also releasing crucial Indicators of Compromise (IOC) and other data to help organisations search for traces of these attack groups in their corporate networks.
“We urge all organisations to carefully scan their networks for the presence of Lazarus malware samples and, if detected, to disinfect their systems and report the intrusion to law enforcement and incident response teams”, added Vitaly Kamluk.
West Africa is fast emerging as a global epicentre for virtual asset adoption, propelled by a young, tech-savvy population and macroeconomic instability, according to Dr. Emomotimi Agama, director-general, Securities and Exchange Commission (SEC) Nigeria.
Dr. Emomotimi Agama, DG, SEC
Speaking at the West Africa Compliance Summit organised by the Inter-Governmental Action Group against Money Laundering in West Africa (GIABA) in Praia, Cape Verde, Dr. Agama warned that while the region’s embrace of digital currencies is accelerating, the absence of coordinated regulation leaves it vulnerable to financial crimes and illicit capital flows.
“With over 60 percent of West Africa’s population under the age of 25 and mobile-first fintech platforms thriving, the region has become a global hotspot for virtual asset adoption,” he said. “But we must act decisively. Regulation is not optional, it is an imperative.”
The summit, themed “Adapting and Thriving in a Complex and Evolving Compliance Landscape,” brought together financial regulators, compliance professionals, and security experts to explore the challenges posed by the rapid rise of virtual assets and decentralised finance (DeFi).
Dr. Agama disclosed that crypto transactions in Nigeria alone surpassed $56 billion in 2024, with citizens increasingly turning to stablecoins such as USDT and USDC to hedge against volatile local currencies.
He highlighted the growing trend of “crypto-dollarisation,” noting that young professionals now demand salaries in stablecoins, while businesses are adopting platforms like Binance Pay for cross-border transactions.
“The naira’s depreciation, Ghana’s cedi weakness, and persistent forex shortages have fueled this shift,” he explained.
“Traditional remittance channels charge up to 10 percent in fees, while cryptocurrencies offer faster and cheaper alternatives. Over $20 billion in remittances flowed into West Africa last year through crypto channels.”
However, he also cautioned that the same innovations driving financial efficiency are increasingly being exploited by fraudsters and criminal actors.
He cited GIABA’s report of $2.1 billion in suspicious crypto-related transactions across West Africa in 2024 alone, including the use of privacy coins by terror financiers to evade detection.
“Unregulated exchanges, artificial market crashes, DeFi ‘rug pulls,’ and Ponzi schemes have wiped out billions in investor funds,” he said. “The recent collapse of the CBEX Ponzi platform is just one of many such incidents. Strong regulation and regional coordination are the only path forward.”
Dr. Agama pointed to Nigeria’s recent legislative progress, especially the enactment of the Investment and Securities Act 2025, which formally classifies virtual assets—including cryptocurrencies, stablecoins, utility tokens, and NFTs—as securities under Section 355(4) and Part I of the Second Schedule.
“Under the new law, all exchanges, wallets, and DeFi platforms must be licensed by the SEC,” he stated.
“We’ve also established a Fintech and Innovation Department to facilitate ongoing dialogue with industry stakeholders and adapt our regulations to emerging realities.”
He called on West African governments to harmonise regulatory frameworks and strengthen intelligence-sharing, proposing a Unified Virtual Asset Service Provider (VASP) Licensing System under the ECOWAS framework.
“A crypto trader banned in Nigeria should not find safe haven in Ghana,” he asserted.
“Financial crime knows no borders. Our collective future depends on our ability to secure this emerging financial frontier.”
Banks in the country have begun suspending instant transaction alerts for cheques drawn from other banks until such cheques are fully cleared.
This is in compliance with a recent directive from the Central Bank of Nigeria (CBN).
This new policy affects customers who receive cheques from other banks, signaling a major change in how cheque payments are confirmed.
According to the CBN directive, the move is intended to prevent confusion around the status of cheque payments and to curb premature release of goods and services before the actual receipt of funds.
In an email sent to its customers, Access Bank stated that moving forward, alerts for cheques deposited into accounts will only be sent after the cheque has been completely processed.
This is to notify you of the recent directive by the CBN which requires banks to send transaction alerts on payments of other bank cheque only upon cheque clearance.
This means that you would only receive alerts for other banks’ cheques paid into your account after the cheque has been fully processed, that is, after the funds are paid into your account or if the cheque is unpaid and and returned from the other bank.
As a result of this new directive, you will no longer receive alerts for cheques lodged into your account until the cheque is cleared or returned”, the bank stated.
Access Bank also advised customers to monitor their accounts through other available channels such as the AccessMore app, internet banking platforms, PrimusPlus, and the USSD service *901# to stay updated on the status of their cheque deposits.
To track your transactions and ensure you do not part with your goods and services prior to payment. Please use our other channels; Accessmore, Internet banking, PrimusPlus, *901#.
We remain committed to delivering seamless and secure banking services to you always”, it said.
The CBN’s directive is designed to protect both payees and payers by ensuring that goods or services are not exchanged before the actual payment has been confirmed.
Previously, customers often received immediate alerts once a cheque was lodged, leading to confusion when the cheque was later dishonoured.
A banking industry insider commented, “This change is critical in promoting financial discipline. It safeguards businesses from losses due to bounced cheques and helps maintain the integrity of cheque payments.”
While digital payment methods are on the rise in Nigeria, cheques still remain a significant payment instrument in various sectors, particularly in wholesale trade and business-to-business transactions.
The apex bank’s new guideline is expected to strengthen trust in cheque transactions by ensuring that payment confirmations are accurate and timely.
As the financial ecosystem evolves, this move is one among several measures aimed at enhancing the safety and reliability of banking transactions across Nigeria.
Credit: Daily Sun
Sterling Financial Holdings Company Plc (“Sterling HoldCo”) has reported a remarkable 157% year-on-year growth in profit-after-tax, hitting ₦41.78 billion for the half-year ended June 30, 2025. This jump from ₦16.26 billion in H1 2024 reflects the Group’s strategic excellence and operational resilience.
Yemi Odubiyi
Profit after tax rose to ₦41.78 billion, while earnings per share climbed to 89 Kobo from 56 Kobo in the prior period. Gross earnings increased by 39.7%, reaching ₦212.61 billion. Interest income grew by 38.3% to ₦167.16 billion, and non-interest income surged 45% to ₦45.45 billion.
The Group’s cost-to-income ratio also improved significantly, declining from 75.7% to 64.5%, thanks to focused cost optimisation.
Sterling HoldCo’s total assets increased to ₦4.08 trillion as of June 2025, up 15.3% from ₦3.54 trillion in December 2024. Shareholders’ funds rose by 22.9% during the period, driven by strong retained earnings and successful recapitalisation. Asset quality also improved, with the non-performing loan ratio down to 5.1% from 5.4%.
Building on its financial strength, the Group completed a ₦100 billion private placement and rights issue, which enabled the recapitalisation of Alternative Bank and bolstered Sterling Bank’s capital base. A public offer to raise an additional ₦53 billion is set to launch in the coming weeks, forming the first phase of a US$400 million capital programme approved at the Group’s Annual General Meeting on June 30, 2025.
Group CEO Yemi Odubiyi attributed the half-year performance to strategic clarity and operational agility, noting that the results reflect resilience and value creation in a dynamic macroeconomic environment.
He reiterated the Group’s commitment to responsible growth, sustainable impact, and continued investment in Nigeria’s growth sectors, including renewable energy, healthcare, and community development.
Sterling HoldCo remains focused on leveraging its robust capital strategy to fuel long-term expansion, innovate across its financial services, and deepen its contribution to Nigeria’s economic progress.
MTN @ First-ever CED, Pledges to Address Subscribers’ Concerns
West Africa Emerging as Crypto Adoption Epicentre- SEC Boss
NOA Warns of Fake N1000 Notes in Circulation, How to Identify Them
Idris, Information Minister Says Only NBC can Suspend Broadcast Licences
Airtel Nigeria Raises Infrastructure Spending to $39m
Telecom3 days agoHistory as MTN Nigeria Becomes First to Hit ₦10 Trillion Market Cap @ NGX
- Telecom3 days ago
MTN Nigeria’s CAPEX Soars Nearly 300 Percent to ₦565.7Bn in Q1 2025
Telecom3 days agoMTN Nigeria Celebrates Super Falcons with ₦150 Million Reward After WAFCON Triumph
General News3 days agoNigeria Sends Egusi, Others to Space @ NASA’s Crew-11 Mission Launch
Telecom3 days agoVitel Wireless Rolls Out 50,000 SIM Cards, eSIMs
General News3 days agoAfDB Approves $46m to Transform Healthcare in Sokoto State
General News3 days agoNITDA DG says Nigeria’s Digital Economy Will Empower Citizens, Bridge Divides, and Drive Unity
News3 days agoExperts Caution e-commerce Operators on Eco-friendly Materials