>To draw attention away from the massive transfers, the hackers often created a diversion, such as a "denial of service" attack that would bombard the website with traffic in an attempt to shut it down, the law enforcement official said.
Corporate banking applications have multitudes of layers of approval, authorised signatories, transaction limits, multiple approvers, etc, and increasingly mobile alerts. By creating chaos in an organisation, it does not mean these break down, but everyone is panicking about something they feel is important, and give scant regard to what seems credible and routine. Exploiting a human fallibility.
Disclaimer: I used to do compliance and security training at a very large financial institution. A huge amount focused on social manipulation via stress and pressure being placed in someone at a critical node of the transaction process.