Categories: Cyber Attack

ATM “black box” – A New Attack to Dispense Money from ATM Terminal

Attackers have adopted a new attack method that includes connecting an external device and also contains parts of the software stack of the attacked ATM.

ATM manufacturer Diebold Nixdorf alerted that they spotted an increase in several jackpotting attacks with black boxes against ProCash terminals in certain European countries.

New black box Attack Type

Jackpotting attack is a type of physical attack in which attackers need to gain Physical access to the targeting ATM Machine.

Then they would connect their device the “black box”, to the dispenser and targets the communication to the cash-handling device directly.

Based on the new incidents Diebold Nixdorf observed that attackers are destroying fascia(front door) of the ATM to gain physical access to the head compartment.

Once they gained access than the “USB cable between the CMD-V4 dispenser and the special electronics, or the cable between special electronics and the ATM PC, was unplugged.”

The unplugged cable connected with a black box of the attacker to dispense the case from the ATM illegally.

In some incidents, it was spotted that the black box contains individual parts of the software stack of the attacked ATM.

“The investigation into how these parts were obtained by the fraudster is ongoing. One possibility could be via an offline attack against an unencrypted hard disc”, reads the PDF report published by Diebold Nixdorf.

Diebold Nixdorf recommended implementing proper countermeasures to thwart these types of attacks and to protect the ATM fleet. Also recommended to check event alerts at regular intervals.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

Advanced ATM penetration testing methods.

ATM Black box attacks – ATM Jackpotting

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Zoom Workplace Apps Vulnerability Enables Malicious Script Injection Through XSS Flaws

A newly disclosed vulnerability in Zoom Workplace Apps (tracked as CVE-2025-27441 and CVE-2025-27442) allows attackers…

1 hour ago

Fortinet Warns of Multiple Vulnerabilities in FortiAnalyzer, FortiManager, & Other Products

Fortinet has revealed and resolved several vulnerabilities within its range of products, such as FortiAnalyzer,…

2 hours ago

Ivanti Released Security Update With The Fixes for Critical Endpoint Manager RCE Vulnerabilities

Ivanti, a prominent enterprise software provider, has issued an urgent security advisory today addressing multiple…

2 hours ago

Over 5,000 Ivanti Connect Secure Devices Exposed to RCE Vulnerabilities

Over 5,000 Ivanti Connect Secure devices remain vulnerable to a critical remote code execution (RCE)…

4 hours ago

CISA Alerts on Actively Exploited CrushFTP Authentication Bypass Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about an actively…

4 hours ago

Over 26,000 Dark Web Discussions Focused on Hacking Financial Organizations

Radware’s comprehensive research into the cybersecurity landscape has uncovered significant trends shaping the financial services…

4 hours ago