$31 Million Stolen From Russian Bank by Unknown Hackers

Hackers have stolen just over 2 billion rubles (the equivalent of 31 million US dollars) in 2016 from accounts kept at the Russian Central Bank. Russia's leading bank already confirmed the cyber thefts and the amount stolen to CNNMoney last Friday.

According to Bank of Russia official, Artiom Sychev, the thieves attempted to steal 5 billion rubles but were stopped by the banking authorities in time to redirect some of the funds.

"We were lucky to return some of money," said one of the bank spokespeople.

It is unclear when exactly the heist happened, and the Russian bank refused to disclose the details, though they did confirm that the heists took place over the year.

Russian Bank Heist Part of a Larger Scheme?

The attack on the Bank of Russia seems to be part of a series of attacks on financial institutions that have been taking place in the last few years.

In January 2015, a group of hackers using the same techniques managed to get their paws on the bank codes for SWIFT ( Society for Worldwide Interbank Financial Telecommunication), the worldwide interbank communication network that settles transactions, of a bank in Ecuador. The cyber-thieves managed to steal 12 million dollars that time.

In October of the same year, Lazarus, a hacker group suspected of being backed by North Korea, attacked a bank in the Philippines using the same techniques. The hackers managed to place trojans on the desktop computers at the bank, though they failed to steal any money, according to reports.

Then, in December 2015, a hacker group attempted to pull the same stunt on a commercial bank in Vietnam, though they were stopped this time.

In February 2016 the cyber thieves got their biggest haul yet. They managed to steal 101 million dollars from Bangladesh's central bank, by exploiting stolen SWIFT codes. The criminals made a total of 5 transfers to from the Bangladesh bank's account at the Federal Reserve Bank of New York, though they attempted a much larger theft. The hackers tried to get away with 951 million dollars but were stopped in time.

Was the Bank of Russia Attacked By The Same People?

According to Symantec, a cyber-security company, the global financial institutions are being attacked by a highly-capable group known as Lazarus. Lazarus has been linked by many to North Korea, though no official information or evidence is available.

Last week, the FSB (Russian Federal Security Service) released a statement, which claimed that hacker attacks against the Russian banking institutions were scheduled on the 5th of December. The attacks were apparently intended to topple Russia's financial system but were stopped in time by the Russian authorities. According to the FSB, a "foreign intelligence services" were behind the foiled attacks, though they didn't specify which country was behind the attack. They did say that hackers were going to use the servers of a company named BlazingFast, a Ukrainian company based in the Netherlands.

Anton Onoprichuk, director of BlazingFast, said that his people "cannot find any malicious data," for CNNMoney. He added that the FSB had not contacted him or the company.

"We reviewed all our systems and network and we have not found any abnormal pattern changes that could lead to FSB's allegations. We must assume FSB has been able to handle the situation without the need of BlazingFast's cooperation. Nevertheless, we hereby publicly demonstrate our willingness to cooperate with any legal entity," the Ukrainian hosting firm posted on Facebook.

Russian Authorities Arrest Hackers

Reuters reported that the Russian law enforcement made several arrests following the daring bank heist. Artyom Sychyov of the Bank of Russia's security department confirmed that the FSB and the Russian Ministry of the Interior made several raids on suspected cyber criminals and that several arrests were made, though no information towards their identity has been given.

Over fifty people were arrested in June this year in similar circumstances, yet it's still not clear if any have been involved in the attacks, and the investigation continues.