Far Eastern International Bank SWIFT heist

In October 2017, Taiwan's Far Eastern International Bank (FEIB) became the latest victim in North Korea's campaign to plunder the global financial system. Attackers later linked to the Lazarus Group planted custom malware inside the bank, hijacked its connection to the SWIFT interbank messaging network, and pushed through fraudulent transfers totalling roughly $60 million before staff noticed.

What happened

The intruders deployed malware described by FEIB as "of a type never seen before" across the bank's computers and servers. The toolset harvested the credentials needed to commandeer the bank's SWIFT terminal — the endpoint that authorises international wire transfers. With control of that terminal, the operators issued instructions moving funds to beneficiary accounts in the United States, Cambodia, and Sri Lanka.

Crucially, the SWIFT network itself was not compromised. As in the 2016 Bangladesh Bank heist, the breach occurred at the bank's own endpoint, where attackers abused legitimate access rather than breaking SWIFT's cryptography.

To slow the bank's response, the attackers detonated Hermes ransomware across FEIB machines. BAE Systems assessed that the encryption was not a money-making scheme but a distraction or cover-up to occupy the security team while the heist completed.

Impact

• Approximately $60 million in fraudulent transfers were initiated.
• Thanks to rapid coordination with correspondent banks and SWIFT, almost all of the money was clawed back — only about $500,000 remained unrecovered.
• Two suspects were arrested in Sri Lanka, including the head of the state-run Litro Gas company, in whose personal account about $1.1 million had landed.

Attribution

Researchers at BAE Systems tied the operation to Lazarus, North Korea's state-linked threat group. Samples reused an x86 variant of the fdsvc.dll backdoor seen in earlier Lazarus attacks in Poland and Mexico, contained Russian-transliterated commands such as "Nachalo" and "vykhodit," and routed money through Sri Lanka and Cambodia — both previously used as Lazarus cash-out destinations. The methodology mirrored the Bangladesh Bank theft.

Why it matters

FEIB demonstrated that the SWIFT endpoint remained a soft target two years after Bangladesh, and that state-sponsored financial theft had become a recurring revenue stream for a sanctioned regime. It also showcased a now-signature Lazarus tactic: pairing a wire-fraud heist with destructive ransomware as cover, foreshadowing the Hermes-derived Ryuk ransomware that would terrorise enterprises in the following years. The near-total recovery underscored that speed of detection and interbank cooperation — not perimeter defences alone — can blunt even a well-resourced nation-state heist.