World's Largest Bank Industrial and Commercial Bank of China's Ransomware Attack: US Authorities Flagged Hacker Methods In March

The recent cyberattack on the New York branch of the Industrial and Commercial Bank of China IDCBY, causing disruptions in the U.S. Treasury market, appears to have exploited three vulnerabilities flagged by U.S. officials earlier this year. 

According to an email obtained by The Wall Street Journal, Treasury officials revealed that the attack involved the Lockbit 3.0 ransomware and leveraged two tactics targeting users of Citrix-managed services.

In March, the FBI and the Department of Homeland Security emphasized the risks associated with the Lockbit ransomware, WSJ writes. Furthermore, the Cybersecurity and Infrastructure Security Agency had recently cautioned companies about vulnerabilities in Citrix.

As the world's largest bank, ICBC plays a significant role in the U.S. Treasury market through its ICBC Financial Services unit, operating within the government securities division of the Fixed Income Clearing Corporation. 

This unit handles the clearance of trades in government bonds among members such as Goldman Sachs, JPMorgan Chase, and smaller interdealer brokers. Although relatively smaller in the Treasury market, ICBC Financial Services holds influence in clearing repo trades for hedge funds, noted Wall Street executives.

Following the attack, ICBC Financial Services had to isolate certain systems, disconnecting from the Treasury market and the Bank of New York Mellon platform that settles its trades. 

Subsequently, the unit manually cleared those trades, yet it remains unconnected to the market, according to WSJ.

The Treasury's Office of Cybersecurity and Critical Infrastructure Protection noted that the two Citrix threats were still under review and would require several days for confirmation.

Disclaimer: This content was partially produced with the help of AI tools and was reviewed and published by Benzinga editors.