Top 5 ATM Malware Families Used By Hackers to Dispense Money from Targeted ATMs

Information

Top 5 ATM Malware Families Used By Hackers to Dispense Money from Targeted ATMs

ATM-Based cyber attacks are continually evolving with much more advanced methods and functions, attackers continuously employ the number of sophisticated malware families to trick the ATMs to dispense cash.

The first ATM skimmer malware designed to launch an attack on ATMs was spotted 10 years before. From the time of discovery, it has evolved to include several different families and different actors behind them.

ATM-based malware can cause significant damage to end users; financial institutions, and targeted banks.

“Over the past 10 years, we have seen a steady increase in the number of ATM malware samples discovered. Still, the number of discovered samples is minimal compared to almost any other malware category,” Talos reported.

Based on the functions, ATM-based malware classified into virtual skimmers and cash dispensers. The Skimmers card data, transaction details, and PINs, whereas the Cash-dispensing malware is used by attackers to dispense cash from ATMs.

The generic framework used by ATM developers is CEN/XFS framework, which allows them to compile and run the code regardless of the ATM model or manufacturer.

ATMs are not available over the internet they will communicate to bank through special channels; however, they will be connected to the internal networks for administration & maintenance purposes, certain malware takes advantage of that by compromising the internal network first.

Top 5 ATM Malware Families

Ploutus

Ploutus malware used by several criminals to empty ATMs through an external keyboard attached to the machine or via SMS message.

The malware was observed since November 2016; it is a standard ATM-dispensing malware; attackers use this to empty ATM without a card.

Alice

Alice malware first detected in November 2016; it will simply empty the safe of ATMs. Alice directly connects with CurrencyDispenser1, upon entering correct PIN it opens operator panel which shows the cassettes were money loaded.

Cutlet

The malware sold in underground hacking forums since 2016, it is a self-paced where the threat actors provide manuals, details such as the required equipment, targeted ATMs models, as well as tips and tricks for the malware’s operation.

This type of malware does not affect bank customers directly; it is intended for the theft of cash from specific vendor ATMs.

Tyupkin

The Tyupkin malware is active since 2014, and it targets Eastern European countries. It is a timely malware to be operated on specific periods.

Attackers need to gain physical access to the ATM to infect them with Tyupkin malware, once the machine infected it disables all the network connections, even if the administrators spotted the suspicious activity it is not possible to shut down.

Skimer

It is the first skimmer malware designed to steal bank card numbers and details of the account and owner details stored on the magnetic stripe attached to the real payment terminals so that they can harvest data from every person that swipes their cards.

Scammers place skimmer that includes a camera, over the built-in customer-facing security camera in ATMs and angles them toward ATM PIN pad to record the user’s PIN.