Introduction: Anatomy of a bank attack
The following scenario presents a realistic, multi-stage cyberattack on a mid-sized bank. It’s based on tactics of known APT groups (Carbanak, Lazarus, FIN7) and the MITRE ATT&CK framework. Each stage includes attacker actions and defense methods that could have prevented escalation.
Attacker objective: gain access to SWIFT or core banking systems to execute unauthorized international wire transfers.
Stage 1: Reconnaissance — Week 1-2
Attacker actions
The APT group gathers information from public sources: organizational structure from LinkedIn, email addresses from data breaches, technologies from job postings (e.g., “seeking Temenos T24 administrator”), subdomains and exposed services. They identify a treasury department employee as a spear phishing target.
How to defend
- OSINT monitoring — tracking bank mentions and employee data leaks on the dark web
- Footprint minimization — limiting technical details in job postings
- Awareness training — treasury staff aware of spear phishing risks
Stage 2: Initial Access — Week 3
Attacker actions
Sending spear phishing to treasury employee: email impersonating a financial regulator with attachment “New Regulatory Guidelines Q1 2026.xlsm”. The Excel macro downloads and executes a Cobalt Strike beacon, establishing C2 (Command & Control) connection via HTTPS on port 443.
How to defend
- Email security with sandboxing — attachment detonation in isolated environment
- MFA and endpoint protection — EDR detecting Cobalt Strike
- Segmentation — treasury workstation in a separate network zone
- SOC — alert on macro execution and suspicious outbound connections
Stage 3: Persistence and Privilege Escalation — Week 3-4
Attacker actions
Cobalt Strike beacon installs persistence (scheduled task, registry key). Attacker escalates privileges: exploit on unpatched Windows service, then credential dump from memory (Mimikatz). Obtains domain administrator password.
How to defend
- Patch management — regular OS and application updates
- PAM — Privileged Access Management with password rotation and monitored sessions
- EDR with Mimikatz and credential dumping detection
- SOC — alert on privilege escalation and unusual AD operations
Stage 4: Lateral Movement — Week 4-6
Attacker actions
With domain admin account, attacker moves through the banking network: RDP to servers, infrastructure mapping, identifying SWIFT and core banking systems. Installing keylogger on SWIFT operator workstations. Collecting transaction system credentials.
How to defend
- Network segmentation — SWIFT zone completely isolated from corporate network
- SOC with lateral movement rules — detecting unusual RDP sessions, new admin logins
- Network Detection and Response (NDR) — east-west traffic analysis
- Privileged account monitoring — alert on admin login to new systems
Stage 5: Exfiltration and attack — Week 7-8
Attacker actions
Attacker prepares fraudulent SWIFT orders using collected credentials. On Friday after business hours, initiates transfers to accounts in Southeast Asia. Simultaneously deploys ransomware on random workstations as a distraction.
How to defend
- Dual authorization on SWIFT orders — requiring two operators with out-of-band confirmation
- SOC — SWIFT transaction monitoring after hours, ransomware detection
- SWIFT Customer Security Programme (CSP) — implementing mandatory controls
- Automatic blocking of suspicious transactions
Stage 6: Incident Response
Bank response
- T+0h: SOC detects ransomware, IR plan activation, infected segment isolation
- T+2h: Forensic analysis reveals Cobalt Strike and fraudulent SWIFT orders
- T+4h: Notification to regulators and law enforcement (DORA requirement)
- T+6h: C2 channel blocking, transfer recall (partial recovery thanks to fast response)
- T+24-72h: Full remediation — rebuild infected systems, reset all passwords, permission review
- T+30 days: Final report for regulators, lessons learned, procedure updates
Key takeaways
- Detection time is critical — the faster SOC detects the attack, the smaller the losses
- Network segmentation — SWIFT/core banking isolation significantly impedes lateral movement
- Defense in depth — no single control will stop an advanced attacker
- IR plan — a tested incident response plan is mandatory (DORA)
- Human factor — awareness training for treasury staff is an investment, not a cost
Penetration testing simulating the above scenario allows assessing a bank’s readiness for a real attack. A security audit identifies gaps in every defense layer.
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
Related topics
See also:
