E-Financial
Kaspersky Exposes How Hackers ‘Lazarus Group’ Terrorise Banks
The results of its more-than-year-long investigation into the activity of ‘Lazarus’, a notorious hacking group allegedly responsible for the theft of 81 million dollars from the Central Bank of Bangladesh in 2016 has been disclosed by Kaspersky Lab.
During the forensic analysis of artefacts left by the group in South-East Asian and European banks, Kaspersky Lab has reached a deep understanding of what malicious tools the group uses and how it operates while attacking financial institutions, casinos, software developers for investment companies and crypto-currency businesses around the world.
This knowledge has helped to interrupt at least two other operations which had one goal – to steal a large amount of money from financial institutions.
In February 2016, a group of hackers (unidentified at that time) attempted to steal $851 million USD, and managed to transfer 81 million USD from the Central Bank of Bangladesh. This is considered to be one of the largest, most successful cyber heists ever.
Further investigation conducted by researchers from different IT security companies including Kaspersky Lab revealed a high chance that the attacks were conducted by Lazarus – a notorious cyber espionage and sabotage group responsible for a series of regular and devastating attacks, and known for attacking manufacturing companies, media and financial institutions in at least 18 countries around the world since 2009.
Although several months of silence followed the Bangladesh attack, the Lazarus group was still active. They had been preparing for a new operation to steal money from other banks and, by the time they were ready, they already had their foot in a financial institution in South East Asia. After being interrupted by Kaspersky Lab products and the following investigation, they were set back for another few months, and later decided to change their operation by moving to Europe. But here too, their attempts were interrupted by Kaspersky Lab’s security software detections, as well as the quick incident response, forensic analysis, and reverse engineering with support from company’s top researchers.
Lazarus Formula
Based on the results of the forensic analysis of these attacks, Kaspersky Lab researchers were able to reconstruct the modus operandi of the group.
Initial compromise: A single system inside a bank is breached either with remotely accessible vulnerable code (i.e. on a webserver) or through a watering hole attack through an exploit planted on a benign website. Once such a site is visited, the victim’s (bank employee) computer gets malware, which brings additional components.
Foothold established: Then the group migrates to other bank hosts and deploys persistent backdoors – the malware allows them to come and go whenever they want.
Internal reconnaissance: Subsequently the group spends days and weeks learning the network, and identifying valuable resources. One such resource may be a backup server, where authentication information is stored, a mail server or the whole domain controller with keys to every “door” in the company, as well as servers storing or processing records of financial transactions.
Deliver and steal: Finally, they deploy special malware capable of bypassing the internal security features of financial software and issuing rogue transactions on behalf of the bank.
Geography and Attribution
The attacks investigated by Kaspersky Lab researchers lasted for weeks. However, the attackers could operate under the radar for months.
For example, during the analysis of the incident in South-East Asia, experts discovered that hackers were able to compromise the bank network no less than seven months prior to the day when the bank’s security team requested incident response. In fact, the group had access to the network of that bank even before the day of the Bangladesh incident.
According to Kaspersky Lab records, from December 2015, malware samples relating to Lazarus group activity appeared in financial institutions, casinos software developers for investment companies and crypto-currency businesses in Korea, Bangladesh, India, Vietnam, Indonesia, Costa Rica, Malaysia, Poland, Iraq, Ethiopia, Kenya, Nigeria, Uruguay, Gabon, Thailand and several other countries.
The latest samples known to Kaspersky Lab were detected in March 2017, showing that attackers have no intention of stopping.
Even though attackers were careful enough to wipe their traces, at least one server they breached for another campaign contained a serious mistake with an important artefact being left behind. In preparation for operation, the server was configured as the command & control center for the malware.
The first connections made on the day of configuration were coming from a few VPN/proxy servers indicating a testing period for the C&C server. However, there was one short connection on that day which was coming from a very rare IP address range in North Korea.
According to researchers, that could mean several things:
The attackers connected from that IP address in North Korea.
It was someone else’s carefully planned false flag operation.
Someone in North Korea accidentally visited the command and control URL.
The Lazarus group heavily invests in new variants of their malware. For months they were trying to create a malicious toolset which would be invisible to security solutions, but every time they did this, Kaspersky Lab’s specialists managed to identify unique features in how they create their code, allowing Kaspersky Lab to keep tracking the new samples. Now, the attackers have gone relatively quiet, which probably means that they have paused to rework their arsenal.
“We’re sure they’ll come back soon. In all, attacks like the ones conducted by Lazarus group show that a minor misconfiguration may result in a major security breach, which can potentially cost a targeted business hundreds of millions of dollars in loss. We hope that chief executives from banks, casinos and investment companies around the world will become wary of the name Lazarus,” said Vitaly Kamluk, Head of Global Research and Analysis Team APAC at Kaspersky Lab.
The company is also releasing crucial Indicators of Compromise (IOC) and other data to help organisations search for traces of these attack groups in their corporate networks.
“We urge all organisations to carefully scan their networks for the presence of Lazarus malware samples and, if detected, to disinfect their systems and report the intrusion to law enforcement and incident response teams”, added Vitaly Kamluk.
PalmPay, Nigeria’s leading digital banking platform, has once again demonstrated its leadership in driving the nation’s payment revolution. In a landmark development for Nigeria’s digital economy, PalmPay, in collaboration with Wema Bank, completed the first live transaction on the Nigeria Inter-bank Settlement System (NIBSS) National Payment Stack (NPS), a next-generation infrastructure designed to redefine how money moves across the country.
The first live transaction, which happened at exactly 11:56 am on Friday, November 7, 2025, marks a new era in Nigeria’s financial innovation journey and reinforces PalmPay’s role as a trusted pioneer in the payment ecosystem.
This achievement rides on the back of the brand’s growing reputation as a fintech innovator, following recent global recognitions as Financial Times Africa’s Fastest-Growing Companies 2025 and CNBC and Statista’s Top 300 Global Fintech Companies for two consecutive years (2024 and 2025) for its impact, scale, and commitment to inclusive growth across emerging markets.
A Milestone that Redefines the Future of Payments
The National Payment Stack (NPS), powered by NIBSS, builds on the success of the NIP infrastructure, introducing greater speed, interoperability and real-time settlement across the financial ecosystem. Designed to meet international standards, NPS enhances cross-border payment capabilities while introducing more advanced security features, including digital signatures and multi-factor authentication to safeguard users and institutions.
Beyond its technical advancements, the National Payment Stack (NPS) sets a new benchmark for Nigeria’s leadership in Africa’s finance landscape. Through the ISO 20022 global messaging standards, Nigeria is now positioned as a regional hub for seamless and secure cross-border transactions.
Commenting on the landmark achievement, the Managing Director/Chief Executive Officer of the NIBSS, Premier Oiwoh, said: “We commend PalmPay for this historic achievement as one of the key collaborators in executing the first successful transaction on the National Payment Stack (NPS). This milestone reflects our shared
commitment to advancing a faster, safer and more interoperable payment ecosystem for Nigeria. The NPS represents the next frontier of innovation designed to power inclusion, efficiency and growth across the financial industry. We look forward to more institutions coming on board as we collectively shape the future of payments in Nigeria and across Africa.”
Also speaking, Jaipei Yan, Group Chief Commercial Officer at PalmPay, stated, “This achievement is a win for Nigeria and Nigerians. PalmPay is all about providing smarter banking solutions. Since our launch six years ago, we have focused on bridging the gap between innovation and everyday financial inclusion. It was an absolute delight to work with NIBSS and other stakeholders on this remarkable milestone.”
By pioneering this milestone, PalmPay not only strengthens its credibility but also reinforces its alignment with the Central Bank of Nigeria’s drive toward a digital, connected economy. From ranking among the world’s leading fintech brands to executing Nigeria’s first live transaction on a national payment infrastructure, PalmPay is proving that innovation, when purpose-driven, can transform economies.
Looking ahead, PalmPay aims to accelerate its vision of a connected, digital, and financially inclusive Africa, combining global standards with local relevance to build technology that truly empowers people and businesses.
Senate has requested the Central Bank of Nigeria (CBN) and the Federal Inland Revenue Services (FIRS) to provide detailed information on revenue generated from Stamp Duty payments.
Sen. Aliyu Wadada, chairman of the Senate Committee on Public Accounts, made this known while briefing newsmen in Abuja on Thursday, according to the News Agency of Nigeria (NAN).
Wadada said the investigation is aimed at ensuring that the government maximises its revenue from the stamp duty, which according to him is a significant source of income for the country.
He said the committee had written to all commercial banks to furnish it with information, accompanied with figures as to how much that particular bank or collectively all the commercial banks have been able to generate from 2016 to 2024 as Stamp Duty Revenue.
He said, “It is of course, by law, expected that whatever these commercial banks put together as revenue from Stamp Duty, charged by the banks, is or are supposed to be remitted to the CBN.
“So, the committee has written to the CBN to furnish it with information, accompanied with figures as to how much has actually been remitted by these commercial banks with CBN and how much the CBN has remitted to the TSA.
“The second category is of course limited liability companies and oil and gas companies. They also charged Stamp Duty like commercial banks. The committee has also written to them.
“This committee has also written to the FIRS for it to furnish the committee with information that should also be accompanied with figures as to how much FIRS has generated on this category of Stamp Duty.”
Wadada said given the need to make the exercise all-encompassing, the committee had also written the Nigerian Governors Forum (NGF) to also provide information on how much they have received as proceeds of Stamp Duty.
He said given the effort and commitment of President Tinubu’s administration to providing needed infrastructure, concerted efforts should be made to ensure generation of revenue and its effective utilisation for the good of Nigerians.
Commercial banks have asked customers to link their accounts to their national identification numbers (NINs) or tax identification numbers (tax IDs) ahead of the implementation of the new tax laws.
In separate notices to customers, the banks said the new laws require all bank accounts to be linked to a tax ID before the effective date.
The financial institutions said customers without a tax ID are required to link their accounts to an NIN.
In a notice, Fidelity Bank stated that under the Nigerian Tax Administration Act (NTAA) 2025, all bank accounts must be linked to a tax ID or NIN by January 1, 2026.
“This implies that accounts without Tax ID or National Identity Number may be restricted from transacting as from January 1, 2026,” the bank said.
“To ensure your account remains accessible, please update your NIN on your account as soon as possible.
“Please use any of the options below to submit your NIN today: Click HERE or visit the NIN portal on our website. Dial *770*02# and follow the prompts.”
Similarly, Ecobank urged its customers to link their NINs on or before November 13, 2025, warning that failure to comply would result in restrictions being placed on accounts.
“You can easily link your NIN and update your account details through the Ecobank Customer Information Portal at https://customerupdate.ecobank.com/ciu/login by following these steps: select update your account details, enter your account number,” Ecobank said.
“Choose your preferred OTP delivery method, select request type and choose NIN updates, input your NIN, then re-enter it for VNIN (verification), click submit to complete the process.
“Alternatively, you may contact your relationship manager or visit the nearest Ecobank branch.”
On September 9, 2025, the federal government gazetted Nigeria’s new tax reform laws, with the implementation set to begin on January 1, 2026.
The laws are the Nigeria Tax Act (NTA) 2025, the NTAA 2025, the Nigeria Revenue Service (establishment) Act, 2025 (NRSEA), and the Joint Revenue Board (establishment) Act, 2025 (JRBEA).FCCPC Sets Deadline For Lending Regulatory Compliance
Airtel Nigeria Unveils Smartphone Financing for New Devices
Kaspersky Introduces Cyber Pathways to Support Career Development in Cybersecurity
Paystack Suspends CTO Ezra Olubi Over Alleged Misconduct, Launches Investigation
Six Students Emerge Abuja Regional Champions in MTN Spelling Bee
AFRIFF 2025: Globe Awards Spotlight African Creativity, Honour Wigwe Legacy
Telecom2 days agoTecom, Huawei to Champion Smart Connectivity and Digital Innovation in Abuja
E-Business2 days agoNITDA DG Tasks Youths to Drive Africa’s Digital Transformation
Telecom2 days agoGirls Slug it Out for N5m Prize in Glo Innov8 STEM Finale
News2 days agoIHS Holding Chairman, Sam Darwish Credits Nigeria for Strong Q3’25 Earnings
E-Business2 days agoAfrica Trade Engine Launches to Boost Intra-Continental Trade, Industrialisation
Telecom2 days agoGroup Opens Call for Session Proposals for the 2026 Digital Rights and Inclusion Forum
Telecom2 days agoAfrica’s TikTok Trailblazers Take the Spotlight at 2025 Awards Ceremony
News24 hours agoFirm Urges Organizations to Check Protection of their Websites Amid Search Engine Optimisation Attack Schemes