Tuesday, April 22, 2025
HomeCyber AttackATM "black box" - A New Attack to Dispense Money from ATM...

ATM “black box” – A New Attack to Dispense Money from ATM Terminal

Published on

SIEM as a Service

Follow Us on Google News

Attackers have adopted a new attack method that includes connecting an external device and also contains parts of the software stack of the attacked ATM.

ATM manufacturer Diebold Nixdorf alerted that they spotted an increase in several jackpotting attacks with black boxes against ProCash terminals in certain European countries.

New black box Attack Type

Jackpotting attack is a type of physical attack in which attackers need to gain Physical access to the targeting ATM Machine.

- Advertisement - Google News

Then they would connect their device the “black box”, to the dispenser and targets the communication to the cash-handling device directly.

Based on the new incidents Diebold Nixdorf observed that attackers are destroying fascia(front door) of the ATM to gain physical access to the head compartment.

Once they gained access than the “USB cable between the CMD-V4 dispenser and the special electronics, or the cable between special electronics and the ATM PC, was unplugged.”

The unplugged cable connected with a black box of the attacker to dispense the case from the ATM illegally.

In some incidents, it was spotted that the black box contains individual parts of the software stack of the attacked ATM.

“The investigation into how these parts were obtained by the fraudster is ongoing. One possibility could be via an offline attack against an unencrypted hard disc”, reads the PDF report published by Diebold Nixdorf.

Diebold Nixdorf recommended implementing proper countermeasures to thwart these types of attacks and to protect the ATM fleet. Also recommended to check event alerts at regular intervals.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Also Read

Advanced ATM penetration testing methods.

ATM Black box attacks – ATM Jackpotting

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Infostealer Attacks Surge 84% Weekly Through Phishing Emails

The volume of infostealer malware distributed through phishing emails has surged by 84% week-on-week...

North Korean IT Workers Use Real-Time Deepfakes to Infiltrate Organizations Through Remote Jobs

A division of Palo Alto Networks, have revealed a sophisticated scheme by North Korean...

New Phishing Technique Hides Weaponized HTML Files Within SVG Images

Cybersecurity experts have observed an alarming increase in the use of SVG (Scalable Vector...

Detecting And Blocking DNS Tunneling Techniques Using Network Analytics

DNS tunneling is a covert technique that cybercriminals use to bypass traditional network security...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Infostealer Attacks Surge 84% Weekly Through Phishing Emails

The volume of infostealer malware distributed through phishing emails has surged by 84% week-on-week...

North Korean IT Workers Use Real-Time Deepfakes to Infiltrate Organizations Through Remote Jobs

A division of Palo Alto Networks, have revealed a sophisticated scheme by North Korean...

Akira Ransomware Launches New Cyberattacks Using Stolen Credentials and Public Tools

The Akira ransomware group has intensified its operations, targeting over 350 organizations and claiming...