The Lazarus Group's Attack on a Bank in India

In June 2018, Adrian's team identify a command and control server that they're confident is being used by the Lazarus group. They can now watch activity happening on this machine in real time. In certain cases, you can see exactly what they have stolen. You can see exactly the commands they've executed to carry out the attacks. It's kind of captured the crime as it was carried out, and it's there as evidence. We don't know exactly what they did, but we do know they managed to get on to some ATM systems.