Securonix analyzes the August 2018 Cosmos Bank intrusion, in which attackers stole more than $13.5 million through coordinated ATM and SWIFT abuse. The excerpt says some sources attributed the activity to Lazarus Group or DPRK-linked Hidden Cobra, while an Indian investigation had not confirmed that link, so the attribution remains qualified. The ATM portion involved earlier malware infection and lateral movement, compromise of the bank's ATM/POS switch, malicious ISO8583 libraries, process injection, and a parallel malicious switch that authorized withdrawals without forwarding requests to the core banking system. The SWIFT portion involved likely lateral movement into the bank's SWIFT SAA environment and three fraudulent MT103 transfers to a Hong Kong account. The report highlights FASTCash-related indicators, including malware hashes and outbound traffic to 75.99.63.27, and argues that transaction monitoring alone is insufficient without endpoint, network, user, and system behavior analytics.