U.S. regulators, FBI warn banks on cyber threat after Bangladesh heist

The notice from the Fed and other financial regulators comes two weeks after the U.S. Federal Bureau of Investigation urged banks to look for signs of possible cyber attacks and asked them to hunt for technical clues that they have been targeted by the same group, according to a notification seen by Reuters.

The warnings suggest that U.S. government and law enforcement agencies are concerned that recent attacks on banks in emerging-market economies could lead to losses for big U.S. firms that rely on the so-called SWIFT fund-transfer network, which serves as the backbone of international finance.

In early February, thieves hacked into Bangladesh Bank's interface with SWIFT's network and peppered the New York Fed with payment instructions. Most of the requests were blocked, but four were filled, amounting to $81 million that went to accounts in the Philippines and remains missing.

"Financial institutions should review their risk management practices and controls over information technology and wholesale payment systems networks, including authentication, authorization, fraud detection, and response management systems and processes," the Federal Financial Institutions Examination Council said in a statement on Tuesday.

Banks using such inter-bank messaging networks and that originate "unauthorized transactions" may be subject to "losses and compliance risk," the council said.

The council - which besides the U.S. central bank includes the Federal Deposit Insurance Corporation and the Comptroller of the Currency, among other agencies - did not issue new cyber security rules, but rather highlighted existing guidelines.

The FBI's notification, which provided technical information about the recent attacks, said a "malicious cyber group" had compromised the networks of multiple foreign banks. "The actors have exploited vulnerabilities in the internal environments of the banks and initiated unauthorized monetary transfers over an international payment messaging system," the May 23 alert said.

The so-called "Flash" notification, which did not identify specific victims, asks recipients to call the FBI if they find any of the technical indicators mentioned in the bulletin or have other "related information."

FBI spokeswoman Nora Scheland declined to comment on the notification, citing a bureau policy on such communications.

"The FBI routinely advises private industry of various cyber threat indicators observed during the course of our investigations," she said. "This data is provided in order to help systems administrators guard against the actions of persistent cyber criminals."

(Reporting by Jim Finkle and Jonathan Spicer; Editing by Chris Reese and Dan Grebler)