- Over months they quietly observe user activity and credentials, incrementally escalating their privelages until they gain access to a connected SWIFT server
- The attackers wait for the optimal weekend, which included a national holiday, so that central bankers would be least available and able to communicate.
- On that weekend the attackers send a series of wires from Bangladesh, to NY, to the Philippines, totalling near $1b
- The attackers cover their tracks by deleting digital records on the Bangladeshi systems and interfering with their printers
- When the money arrives in the Philippines it is laundered through a complex system of casinos involving Macau and North Korea
- In the end "only" $81m was stolen, rather than $1b, because one of the wires referenced an organization with the word "Jupiter" in its name, which by dumb luck happened to be a word on an international blacklist due to a completely unrelated company with a similar name that broke Iran sanctions, triggering an investigation.
The main weakness seems to be that the Philippines does not enforce proper kyc/aml and is therefore a haven for laundering - otherwise it would be difficult to get the money to an actual human, even if SWIFT was coerced into sending invalid transactions.