Tuesday, April 16, 2024

Top 5 ATM Malware Families Used By Hackers to Dispense Money from Targeted ATMs

ATM-Based cyber attacks are continually evolving with much more advanced methods and functions, attackers continuously employ the number of sophisticated malware families to trick the ATMs to dispense cash.

The first ATM skimmer malware designed to launch an attack on ATMs was spotted 10 years before. From the time of discovery, it has evolved to include several different families and different actors behind them.

ATM-based malware can cause significant damage to end users; financial institutions, and targeted banks.

“Over the past 10 years, we have seen a steady increase in the number of ATM malware samples discovered. Still, the number of discovered samples is minimal compared to almost any other malware category,” Talos reported.

Based on the functions, ATM-based malware classified into virtual skimmers and cash dispensers. The Skimmers card data, transaction details, and PINs, whereas the Cash-dispensing malware is used by attackers to dispense cash from ATMs.

The generic framework used by ATM developers is CEN/XFS framework, which allows them to compile and run the code regardless of the ATM model or manufacturer.

ATMs are not available over the internet they will communicate to bank through special channels; however, they will be connected to the internal networks for administration & maintenance purposes, certain malware takes advantage of that by compromising the internal network first.

Top ATM Malware Families
Image Credits: Talos

Top 5 ATM Malware Families


Ploutus malware used by several criminals to empty ATMs through an external keyboard attached to the machine or via SMS message.

The malware was observed since November 2016; it is a standard ATM-dispensing malware; attackers use this to empty ATM without a card.


Alice malware first detected in November 2016; it will simply empty the safe of ATMs. Alice directly connects with CurrencyDispenser1, upon entering correct PIN it opens operator panel which shows the cassettes were money loaded.


The malware sold in underground hacking forums since 2016, it is a self-paced where the threat actors provide manuals, details such as the required equipment, targeted ATMs models, as well as tips and tricks for the malware’s operation.

This type of malware does not affect bank customers directly; it is intended for the theft of cash from specific vendor ATMs.


The Tyupkin malware is active since 2014, and it targets Eastern European countries. It is a timely malware to be operated on specific periods.

Attackers need to gain physical access to the ATM to infect them with Tyupkin malware, once the machine infected it disables all the network connections, even if the administrators spotted the suspicious activity it is not possible to shut down.


It is the first skimmer malware designed to steal bank card numbers and details of the account and owner details stored on the magnetic stripe attached to the real payment terminals so that they can harvest data from every person that swipes their cards.

Scammers place skimmer that includes a camera, over the built-in customer-facing security camera in ATMs and angles them toward ATM PIN pad to record the user’s PIN.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep yourself updated.

Other Malwares

Malicious Hackers Steal Money From ATM by Connecting Laptop with ATM Cash Dispenser

Most of the ATM’s Around the World Can be Hacked Under 30 Minutes

ATMJackpot – New Malware Steal Your Money From ATM using ATM Jackpotting Technique

Now Anyone Can Buy New ATM-based Malware In Darkweb and Get All Money From ATM Anonymously

ATM Robber Malware Turns ATM into Slot Machine to Dispense Cash Automatically

Malicious Hackers Selling Malware’s Targeting Bitcoin ATMs in the Dark Web Forums

Malware Called “ATMii” allows Hackers to Dispense all the Cash from the ATM

A Fileless Malware Called “ATMitch” Attack The ATM machines Remotely and Delete The Attack Evidence


Latest articles

Trustifi’s Email Security Awareness Training – Empowering MSPs to Train & Protect Clients

In today's digital landscape, email security has become a critical concern for businesses of...

Personal Data Exposed in Massive Global Hack: Understanding the Implications & Guarding Privacy- Axios Security Group

In a digital age where information is the new currency, the recent global hack...

Ex-Security Engineer Jailed For Hacking Decentralized Cryptocurrency Exchanges

Ahmed exploited a vulnerability in a decentralized cryptocurrency exchange's smart contract by injecting fabricated...

Omni Hotels & Resorts Hack: Attackers have Stolen Customer Information

Omni Hotels & Resorts has revealed that it was the target of a recent...

Connect:fun Attacking Organizations Running Fortinet’s FortiClient EMS

A new exploit campaign has emerged, targeting organizations that utilize Fortinet’s FortiClient EMS.Dubbed...

TA558 Hackers Compromised 320+ Organizations’ FTP & SMTP Servers

TA558, a financially motivated threat actor identified in 2018, is targeting several countries but...

Blackjack Hackers Destroyed 87,000 Sensors Using Lethal ICS Malware

A group of cybercriminals known as "Blackjack" has launched a devastating attack on industrial...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles