The ₹94 Crore Cosmos Bank Cyber Heist: Forensic Breakdown of the ATM Switch Malware & SWIFT Bypass
1. Executive Summary & Scale of the Breach
On August 11 and 13, 2018, Pune-headquartered Cosmos Co-operative Bank Ltd., one of India's oldest urban cooperative banks, suffered a coordinated multi-stage cyber assault resulting in the siphoning of ₹94.42 Crore ($13.5 Million USD). Unlike conventional phishing or credential theft, this incident was an advanced persistent threat (APT) attack targeting the bank's core payment infrastructure: the ATM Switch Server and the SWIFT (Society for Worldwide Interbank Financial Telecommunication) international transaction gateway.
2. Attack Timeline & Modus Operandi
Forensic investigations by Maharashtra Cyber, Pune Cyber Cell, and international forensic agencies revealed a dual-pronged tactical execution:
⏱️ Stage 1: Network Intrusion & Proxy Switch Deployment (Aug 11, 2018)
The threat actors gained initial foothold through spear-phishing emails carrying sophisticated remote access trojans (RATs). Once inside the internal network, attackers moved laterally to the bank's Card Management System (CMS) and ATM Switching Server.
They isolated the authentic Core Banking Solution (CBS) and stood up a Rogue / Proxy Switching Server that intercepted ISO 8583 payment authorization messages. When an ATM requested transaction authorization, the rogue server automatically injected fake "APPROVED" responses without querying the core balance or debiting customer accounts.
⏱️ Stage 2: Synchronized Global ATM Cashout (14,000+ Transactions in 28 Countries)
Over a span of approximately 2 hours and 20 minutes, money mule networks using cloned RuPay and VISA debit cards conducted over 12,000 ATM withdrawals in 28 foreign countries (including Canada, Hong Kong, Russia, and the UK) withdrawing ₹78 Crore, while 2,849 domestic ATM transactions in India siphoned an additional ₹2.5 Crore.
⏱️ Stage 3: SWIFT Wire Transfer Exfiltration (Aug 13, 2018)
Two days later, the adversaries logged into the bank's SWIFT terminal using compromised operator credentials and dispatched fraudulent MT103 financial messages, transferring ₹13.92 Crore directly to an account held at Hang Seng Bank in Hong Kong.
3. Key Vulnerabilities Exploited
- Inadequate Network Micro-Segmentation: The ATM switch infrastructure was not completely isolated from general corporate endpoints and email gateways.
- Absence of Real-Time Anomalous Velocity Triggers: The ATM switch failed to flag thousands of simultaneous international transactions originating from cards that had never been used overseas.
- Unencrypted ISO 8583 Message Relays: Absence of end-to-end cryptographic payload verification between the core banking system and the payment gateway.
4. Strategic Defense & RBI Compliance Playbook for Financial Institutions
🛡️ Mandatory Security Controls:
- Zero Trust Network Architecture (ZTNA): Enforce strict air-gapping and cryptographic mutual TLS between Core Banking and Switch engines.
- Real-time Behavioral Velocity Monitoring: Automated circuit breakers that halt payment processing if transaction spikes exceed 300% of baseline.
- Multi-Custodian SWIFT Terminal Access: Hardware token-based dual-control authorization for all outbound SWIFT MT103/MT202 messages.
🛡️ Share This Cyber Defense Investigation
Help protect family, senior citizens, and colleague networks across India by sharing verified forensic case files.
💬 SHARE ON WHATSAPP →