Respected Gartner analyst Avivah Litan has claimed in a blog post that cyber crooks have used comparatively low levelDDoS – distributed denial of service – attacks to confuse anddistract financial institution security staffs as fraudulent wiretransfers were in motion.

In an interview with SC Magazine, Litan offered more specifics, claiming thatshe knows of three incidents in the past few months in whichDDoS was used in heists involving “millions” of dollars.

Litan explicitly indicated that these DDoS attacks were unlikethe high volume DDoS that in the past year have taken down manyU.S. financial institutions including $3.8 billion, PleasantonCalif.-based Patelco Credit Union and University Federal Credit Union, a $1.5 billion institution inAustin, Texas. No thefts have been associated with thesepolitically motivated attacks.

Regarding the incidents she blogged about, Litan told SCMagazine: “It wasn't the politically motivated groups. It wasa stealth, low-powered DDoS attack, meaning it wasn't somethingthat knocked their website down for hours.”

Litan declined to name the institutions that she said sufferedsignificant losses in these DDoS assaults.

Some months ago, security blogger Brian Krebs reported on a $900,000 heist at Bank of the West where DDoSalso was used as a distraction.

In her recent blog. Litan offered details about how the attackunfolds: “Once the DDoS is underway, this attack involves takeoverof the payment switch (e.g. wire application) itself via aprivileged user account that has access to it. Now, instead ofhaving to get into one customer account at a time, the criminalscan simply control the master payment switch and move as much moneyfrom as many accounts as they can get away with until their actionsare noticed.”

She advised institutions that when under a DDoS attack that they“slow” the wire transfer systems.