Covid-19 Provides Cover for Hackers

The travails of a banking software maker show how vulnerable corporate security is

- By Jordan Robertson

Hackers silently entered the computer network of London-based banking software maker Finastra in mid-March as the company was focused on developing emergency plans for operating amid the emerging coronavirus pandemic. Moving with precision and speed, they captured employee passwords and installed backdoors in dozens of servers in critical parts of Finastra’s network.

Although hardly a household name, Finastra Group Holdings Ltd. is an essential part of the global financial system, its software and services running everything from banks’ websites to the back-office systems they use to manage their own money. Its more than 8,500 customers include 90 of the world’s 100 largest banks.

For about three days the attack went unnoticed, but the hackers’ activity on one of Finastra’s cloud servers set offa tripwire that alerted the company’s security team and triggered a destructive finale to the intrusion. On March 20 the hackers—apparently aware they were being hunted—began detonating a potent strain of ransomware called Ryuk.

As the malware quickly spread, locking up server after server, Finastra’s information security team evaluated its dwindling options before settling on the nuclear one: The company pulled all potentially infected servers offline. First hundreds, then thousands, came down. The attack ground to a halt—as did critical parts of Finastra’s business. In an instant, services for many of its customers went dark.

The inside story of Finastra’s breach—which