Great write up and it certainly sounds like an inside job. I mean, it seems the authors of the malware had an incredible amount of insight into the entire SWIFT platform anyway.
Registering for SWIFT training is easy enough, especially in developing countries where verification can be harder achieve. https://www.swift.com/our-solutions/services/training?AKredi...
Gaining access to swift.com through either "proper" registration or phising will get you access to the SWIFT SDK as well as tons of other material. So no sorry but to me and to anyone else who's even remotely familiar with how shitty SWIFT and usual banking internal security is, it doesn't sound like an inside job, just a job well done.
This strongly points to an inside job, but does not exclusively prove it.
If you can present an all clear signal to the bank staff at all the immediate human readable interfaces no one would notice, at best the fraudulent transactions would be detected 30+ days down the line when the banks perform account consolidation.
This is a good post about how money moves around between banks https://gendal.me/2013/11/24/a-simple-explanation-of-how-mon... it doesn't go into payment/messaging systems (i.e. SWIFT) too much which is a good thing but it does explains how bank handle and settle transfers.
SWIFT is a glorified messaging service for banks, that's how it started, today allot of "out of the box" applications have been developed on it but in it's core SWIFT is just a trusted network that enabled it's members to securely transfer messages between each other, these messages often end up being used to facilitate transactions but they aren't what actually moves money around.
However they gained the knowledge, it is incredible.
To get a swift.com account you need to have details, name, institution code (BIC code for banks) and some additional details.
SWIFT doesn't handle the authorization the institution you are registering on behalf does which means it's probably even more easier to phish/social engineer yourself in.
Gaining access to swift.com credentials also shouldn't be that hard, especially if have already compromised the bank's network or any of it's employees.
To get access to the SWIFT documentation and other materials you also don't have to compromise your initial target which makes it even easier.
Registration to SWIFT's "Mystandards" is open to the public completely which both gives you access to quite a bit of information as well as allows to you participate in discussion groups which may lead to a few more vectors for social engineering.