Bangladesh Bank SWIFT heist
Attackers spent weeks inside Bangladesh Bank's network, obtained credentials for its SWIFT payment terminals and sent fraudulent transfer requests worth close to $1 billion. Most were blocked, but about $81 million was lost. Malware also tampered with the bank's SWIFT software to hide the transactions.
Hunts for unusual logons and processes on payment-connected hosts, tampering with financial application files, and out-of-hours activity long before money moves.